CVE-2026-23750

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-23750

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23750.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-23750

Published

2026-02-26T17:33:13Z

Modified

2026-08-12T03:51:32Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow

Details

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23750.json"
}

References

Affected packages

Git / github.com/golioth/pouch

Affected ranges

Type

GIT

Repo

https://github.com/golioth/pouch

Events

Introduced

73662de4b2b7f93119570ba2f8c1217b5e964d5f

Fixed

1b2219a1

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "last_affected": "0.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23750.json"