Golioth Pouch version 0.1.0 before commit 1b2219a1 contains a heap-based buffer overflow in the BLE GATT server certificate handling. The server_cert_write() routine allocates a buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment and later uses memcpy() to append subsequent fragments without verifying that the buffer still has enough capacity. An unauthenticated BLE client can send fragments whose combined size exceeds the allocated buffer, leading to a heap overflow that can crash the service and, because memory corruption is involved, also threaten the integrity of data stored on the device.

The vulnerable product is Golioth Pouch, a BLE GATT server application released by Golioth. The issue affects version 0.1.0 and any releases before the security commit identified by hash 1b2219a1, which provides the necessary fix.

The CVSS score of 7.2 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an attacker with the ability to communicate over BLE with the affected device could send unauthenticated certificate fragments that exceed the predetermined buffer limit. This would trigger a heap overflow, potentially leading to a crash and memory corruption that can alter device state.