The vulnerability is an out-of-bounds read during CoAP OSCORE CBOR unwrap processing in libcoap. The buggy code uses get_byte_inc without bounds checking when assertions are disabled, allowing an attacker to send a malformed OSCORE option or response to trigger a read beyond allocated memory and, due to integer wraparound in allocation size computation, a heap buffer overflow. This can corrupt memory, potentially enabling code execution or causing a crash, with a primary impact of memory corruption.

The flaw exists in the libcoap library, any application or device that links to libcoap and enables OSCORE support is potentially affected. No specific product versions are listed, so all releases of libcoap that have not applied the referenced fix are at risk.

The CVSS base score of 8.8 indicates high severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, so no active exploitation has been documented. The likely attack vector is remote, via network traffic, because CoAP is a network protocol; an attacker must be able to inject crafted CoAP messages that trigger the vulnerability. The absence of a low EPSS score suggests that exploitation is possible but not widespread yet.