Is CVE-2026-23750 actively exploited?

No active exploitation of CVE-2026-23750 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-23750 be exploited remotely?

Partially. CVE-2026-23750 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-23750?

CVE-2026-23750 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-23750

HIGH

CVE-2026-23750

CWE-122Published: February 26, 2026· Updated: Feb 27, 2026

8.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.7th

Official Description

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.

NVD Source

Technical Analysis

CVE-2026-23750 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.