CVE-2020-12883
Description
Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the option delta and option length bytes. The actual input packet length is not verified against the number of bytes read when processing the option extended delta and the option extended length. Moreover, the calculation of the message_left variable, in the case of non-extended option deltas, is incorrect and indicates more data left for processing than provided in the function input. All of these lead to heap-based or stack-based memory location read access that is outside of the intended boundary of the buffer. Depending on the platform-specific memory management mechanisms, it can lead to processing of unintended inputs or system memory access violation errors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A buffer over-read vulnerability in Mbed OS 5.15.3's CoAP parser allows remote attackers to cause out-of-bounds reads via crafted packets.
Vulnerability
A buffer over-read vulnerability exists in the CoAP library of Arm Mbed OS 5.15.3. The flaw resides in the sn_coap_parser_options_parse() function, which parses CoAP packet options. Due to incorrect calculation of remaining message length and missing boundary checks for option delta and length fields, a crafted packet can trigger out-of-bounds reads from heap or stack memory [1][2].
Exploitation
An attacker can exploit this vulnerability by sending a specially crafted CoAP packet to a device running Mbed OS 5.15.3. The attacker does not require authentication or any special network position as CoAP is typically used over UDP. The malicious packet contains option fields with manipulated delta and length values that bypass the parser's length checks, causing it to read memory beyond the input buffer boundaries [1].
Impact
Successful exploitation leads to a heap-based or stack-based out-of-bounds read. This can result in processing of unintended data or system memory access violations, potentially causing a denial of service or information disclosure. The exact impact depends on the platform's memory management and the context of the vulnerable code [1].
Mitigation
The vulnerability was addressed in a commit to the mbed-coap repository (Pull Request #116), which introduced improved boundary checks and overflow detection [2]. Users should update to a version of Mbed OS that includes this fix. No workarounds are documented; users are advised to apply the patch as soon as possible [1][2].
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Arm/Mbed OSdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/ARMmbed/mbed-coap/pull/116mitrex_refsource_CONFIRM
- github.com/ARMmbed/mbed-os/issues/12925mitrex_refsource_MISC
- github.com/ARMmbed/mbed-os/issues/12926mitrex_refsource_MISC
- github.com/ARMmbed/mbed-os/issues/12927mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.