The option parsing logic in ccoap fails to validate option numbers when processing CoAP messages. Malformed option numbers lead to an out-of-bounds access that causes the program to crash with a segmentation fault. This crash terminates the ccoap process and disrupts any services dependent on it, resulting in a denial of service for legitimate users.

The flaw exists in the ccoap implementation identified by commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. Any installation of ccoap that includes this commit or earlier, without applying an update that removes the vulnerability, is impacted. No vendor or product name was supplied, so the scope is limited to environments running this software.

An attacker who can reach the exposed CoAP endpoint may send crafted messages that trigger the crash, causing a service interruption. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, but the CVSS score of 7.5 indicates high severity if the fault is triggered. The vulnerability is not listed in the CISA KEV catalog. The attack vector likely involves remote network traffic directed at the CoAP service.