The vulnerability is an out-of-bounds read during CoAP OSCORE CBOR unwrap processing in libcoap. The buggy code uses get_byte_inc without bounds checking when asserts are disabled, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation. This can corrupt memory or cause a crash, with a primary impact of memory corruption.

The flaw exists in the libcoap library, any application or device that links to libcoap and enables OSCORE support is potentially affected. No specific product versions are listed, so all releases of libcoap that have not applied the referenced fix are at risk.

The CVSS base score of 8.8 indicates high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so no active exploitation has been documented. Based on the description, the likely attack vector is remote via network traffic, as the vulnerability is triggered by crafted CoAP messages sent over the network. The absence of a high EPSS score suggests that exploitation is possible but not widespread yet.