PT-2026-33518 · Libcoap · Libcoap

Kazuma Matsumoto · Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-29013

NVD

CVSS v4.0

8.8

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get byte inc() in src/oscore/oscore cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause heap buffer overflow writes through integer wraparound in allocation size computation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-29013

Affected Products

Libcoap

References · 3

• https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-29013 · Security Note
• https://vulncheck.com/advisories/libcoap-out-of-bounds-read-in-oscore-cbor-unwrap-handling · Note