CVE-2026-5855 Contiki-NG CVE debrief

Who should care

Organizations using Contiki-NG, especially those in constrained device environments, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating affected systems, applying patches, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should prioritize patching to prevent potential memory disclosure.

Technical summary

The LwM2M TLV parser in Contiki-NG has a bounds check issue, allowing for up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer when a crafted CoAP WRITE is sent to any LwM2M endpoint. This occurs because the parser ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller iterates while there is at least one byte remaining, triggering the out-of-bounds reads. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.

Defensive priority

Organizations using Contiki-NG should prioritize patching to prevent potential memory disclosure.

Recommended defensive actions

• Apply patches from Contiki-NG
• Review and update affected systems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE description indicates a bounds check issue in Contiki-NG's LwM2M TLV parser. Official CVE and NVD records provide details. The vulnerability allows for up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer when a crafted CoAP WRITE is sent to any LwM2M endpoint. Organizations should verify affected systems and review vendor guidance for patching. Evidence is limited to public CVE and NVD records.

Official resources