Golioth Pouch version 0.1.0 is vulnerable to a heap-based buffer overflow in its BLE GATT interface, which allows an unauthenticated, adjacent attacker to crash the device or corrupt memory.

The vulnerability exists in the server_cert_write function within server_cert_characteristic.c, where incoming BLE GATT fragments are appended to a heap buffer without sufficient capacity verification. An unauthenticated attacker within Bluetooth range can send fragments that exceed the allocated buffer size, resulting in a heap overflow.

Successful exploitation of this vulnerability allows for memory corruption and potential system crashes, which can lead to a denial of service for critical IoT infrastructure. Given that this flaw is reachable by any unauthenticated attacker within radio range, the risk to fleet availability and operational integrity is high. The CVSS score of 8.1 reflects the significant impact on system integrity and availability, despite the requirement for adjacent proximity.

Immediate Action: Update Golioth Pouch to a version containing the fix for commit 1b2219a159bcbef3f37caa303bbf14d14e979c11. If an immediate update is not possible, disable BLE GATT services if they are not strictly required for current operations.

Proactive Monitoring: Monitor device logs for unexpected reboots or crashes, which may indicate attempted exploitation of memory safety vulnerabilities.

Compensating Controls: Implement physical security measures to restrict unauthorized access to the immediate Bluetooth radio range of deployed IoT devices.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the SecMate technical disclosure.

This vulnerability presents a serious risk to the stability and security of IoT devices using the Pouch protocol. Because the entry point requires no authentication and is accessible to any nearby BLE client, the attack surface is broad for devices in public or accessible environments. Administrators must prioritize applying the upstream patch to remediate this heap overflow and prevent potential code execution or service disruption.