A stack‑based buffer overflow exists in the Golioth Firmware SDK’s Payload Utils, specifically in the golioth_payload_as_int() and golioth_payload_as_float() functions. The vulnerability arises from unchecked memcpy() calls that copy network‑supplied payload data into fixed‑size stack buffers without verifying the payload length. When the payload exceeds 12 bytes for integers or 32 bytes for floats, the overflow can corrupt the stack, causing a crash and denying service to the device. The overflow does not provide direct code execution but can be leveraged to disrupt firmware operation.

All Golioth Firmware SDK installations built from version 0.10.0 up to, but not including, 0.22.0 are affected. The exploit relies on the SDK being used in environments where LightDB State on_payload is active and can receive payloads from a server or man‑in‑the‑middle attacker.

The CVSS score of 6.3 indicates a moderate risk level, while the EPSS probability of less than 1% suggests exploit attempts are expected to be very rare. The vulnerability is not listed in the CISA KEV catalog. The attack vector is reachable through the LightDB State on_payload interface, requiring an attacker to supply a malicious server‑generated payload that exceeds the safe buffer limits. If executed, the exploit would crash the firmware, causing a denial of service but not providing remote control or data exfiltration capabilities.