A critical use-after-free vulnerability in the libcoap library presents a significant risk of remote code execution for applications utilizing this library.

This is a use-after-free vulnerability occurring in the coap_delete_pdu_lkd function within coap_pdu.c. It can be triggered by an unauthenticated attacker, potentially leading to service crashes or arbitrary code execution.

The ability for an unauthenticated attacker to trigger a use-after-free condition in a networking library creates a high risk of service disruption or system compromise. With a CVSS score of 9.8, this vulnerability is highly critical for any infrastructure relying on libcoap, as it could lead to full system takeover.

Immediate Action: Review the libcoap project's official security advisories and GitHub issues to identify the specific patched release.

Proactive Monitoring: Monitor system logs for unexpected crashes or segmentation faults in services that utilize the libcoap library.

Compensating Controls: Restrict network access to services utilizing libcoap using network segmentation or firewall rules to limit the exposure of the library to untrusted traffic.

Public Exploit Available: Unknown.

Organizations using libcoap must prioritize monitoring the project's upstream repository for a fix. Given the high CVSS score and the existence of a proof-of-concept, users should treat this as a high-priority item and prepare to patch as soon as the vendor releases a security update.