The ccoap library contains an option parsing flaw that causes a segmentation fault when it receives a COAP message with options whose data is insufficient. The fault results from attempting to read beyond the available bytes, which triggers an out‑of‑bounds read/write (CWE‑787). The crash terminates the process, disrupting the service and leading to a denial of service.

Affected systems are those that include the vulnerable ccoap code at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. Devices or applications that parse COAP messages using this library—common in embedded or IoT environments—will be impacted.

The CVSS score of 7.5 signals a high severity vulnerability. The EPSS score is below 1%, indicating that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker crafting malformed COAP messages and sending them over the network to provoke the segmentation fault, which would cause a service outage.