The flaw resides in Contiki-NG's LwM2M TLV parser function lwm2m_tlv_read(), which neglects the buffer length provided by its caller and reads up to six bytes from the input buffer without bounds checking. Because the calling code in lwm2m-engine.c only verifies that at least one byte remains, a crafted CoAP WRITE request that ends with a TLV carrying exactly one byte causes the parser to perform up to five reads beyond the buffer’s end. These out-of-bounds reads expose heap memory contents, including sensitive key material and peer addresses, through the parsed TLV fields, and corrupt parsing state via a corrupted tlv_len. The weakness is an unchecked read, CWE-125, and the primary impact is disclosure of confidential memory contents.

This vulnerability affects all installations of the Contiki‑NG operating system that include the LwM2M module using the current TLV parser implementation. The flaw is present in every release prior to the patch committed in the Contiki‑NG repository (commit f1673b5766d4d4d514cefb8a0350f43653574997). No specific vendor versions are listed; however, any system using LwM2M in NoSec mode, which is the default for constrained devices, is exposed when it receives an outbound CoAP WRITE.

The CVSS score of 8.7 indicates high severity, and the exploitation probability is not available, though no KEV listing suggests no widespread exploitation has been observed. The vulnerability can be triggered remotely by sending a malformed CoAP WRITE message from an unauthenticated source; in NoSec mode there is no authentication required, so an attacker controlling any device capable of reaching the target can craft the request. Because the flaw reveals in-memory secrets and can corrupt parsing state, an attacker can read sensitive data and potentially destabilize the device, leading to a denial of service.