Vulnerability · Published Feb 26, 2026 · Assigned by VulnCheck

CVE-2026-23750Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow

High 8.1

In plain English

A high-severity heap buffer overflow in Pouch from Golioth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 94.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.

Affected products (as reported)

Vendor	Product	Versions
Golioth	Pouch	0.1.0

Weakness: CWE-122 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

https://secmate.dev/disclosures/SECMATE-2025-0018 technical-description
https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/ technical-description, exploit
https://github.com/golioth/pouch/commit/1b2219a1 patch
https://www.vulncheck.com/advisories/golioth-pouch-ble-gatt-heap-based-buffer-overflow third-party-advisory