When operating in LwM2M NoSec mode, which is the default configuration for many constrained devices, this vulnerability can be triggered by an unauthenticated attacker sending a crafted CoAP WRITE request. The vulnerability is triggered when the final TLV field in the request contains exactly one byte. Successful exploitation allows for the disclosure of sensitive heap memory, potentially exposing cryptographic key material, peer addresses, and other internal state information. Furthermore, the resulting corruption of the tlv_len field can lead to downstream processing logic failures or further memory corruption.

Impact

Successful exploitation of CVE-2026-5855 enables unauthorized information disclosure from the device's heap memory. Given the context of constrained IoT devices running Contiki-NG, this may result in the compromise of static cryptographic keys or network topology metadata. The vulnerability is particularly dangerous because it does not require authentication in default NoSec deployments, increasing the likelihood of remote exploitation against exposed IoT infrastructure.

Recommendation

• Audit network edge traffic for CoAP WRITE requests targeting constrained devices running Contiki-NG.
• Implement strict ingress filtering to restrict CoAP traffic to authorized network segments, as NoSec LwM2M is inherently vulnerable to unauthenticated access.
• Apply the vendor-provided patch for os/services/lwm2m/lwm2m-tlv.c to enforce correct buffer bounds checking in the lwm2m_tlv_read function.
• Monitor for unusual CoAP traffic patterns, specifically malformed WRITE payloads characterized by single-byte final TLVs that may indicate exploitation attempts.