CVE-2026-29013

OVERVIEW CVE-2026-29013 is an out-of-bounds read vulnerability in libcoap's OSCORE (Object Security for Constrained RESTful Environments) implementation, specifically in the CBOR unwrap handling function get_byte_inc() located in src/oscore/oscore_cbor.c. The vulnerability arises because bounds checking relies exclusively on assert() statements, which are disabled in release builds compiled with the NDEBUG flag, leaving the code unprotected in production environments. SEVERITY The vulnerability can be triggered through a network vector by sending crafted CoAP requests with malformed OSCORE options or malicious responses during OSCORE negotiation. Attack complexity is low, requiring minimal attacker sophistication. The potential impact includes out-of-bounds memory reads and potential heap buffer overflow writes caused by integer wraparound in allocation size computation during CBOR parsing. While a specific CVSS score is unavailable, the FAUCET Risk Score of 42.0/100 indicates moderate concern, and the EPSS score of 0.000470 suggests relatively low probability of exploitation in the wild compared to other CVEs. EXPLOITATION STATUS The vulnerability has not yet been formally added to the Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation at this time. However, the vulnerability is listed on the Hot List and remains active, suggesting it warrants close monitoring. No publicly available exploit code has been reported, though the technical details provided could enable reverse engineering of exploitation methods.