Out-of-Bounds Read Vulnerability in libcoap Affecting CoAP Protocols

CVE-2026-29013

What is CVE-2026-29013?

libcoap features an out-of-bounds read vulnerability in the handling of OSCORE requests, specifically in Appendix B.2 related to CBOR unwrapping. The function get_byte_inc() in src/oscore/oscore_cbor.c solely uses assert() for bounds verification, a feature absent in release builds compiled with the NDEBUG flag. This flaw allows attackers to exploit malformed OSCORE options or responses in CoAP requests, which could lead to out-of-bounds reads during CBOR parsing. The resulting consequences may include heap buffer overflow writes due to integer wraparound during allocation size computations.

References