The vulnerability is an out‑of‑bounds read in the LightDB state string parsing routine of the Golioth Firmware SDK. When a payload is received, a payload_size value less than 2 triggers a size_t underflow during nbytes calculation, causing a memcpy to read past the end of the network buffer. This can crash the device, leading to a denial‑of‑service condition.

The issue affects all releases of the Golioth Firmware SDK prior to 0.22.0, including the publicly available 0.10.0 version. Users deploying these versions should check the SDK version in their firmware and update if necessary.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. However, the vulnerability is remote and reachable from a malicious server or MITM attacker controlling the payload. Once triggered, the device will crash, so the attack can cause widespread service interruption if exploited on numerous endpoints.