CVE-2021-22547: Google Cloud IoT Device SDK For Embedded C

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger than the buffer and wrap around to have a smaller buffer than required, allowing the attacker access to the other parts of the heap. We recommend upgrading the Google Cloud IoT Device SDK for Embedded C used to 1.0.3 or greater.

Affected products

• Google Cloud IoT Device SDK For Embedded C: before 1.0.3 (fixed in 1.0.3)

Published 2021-05-04. Last modified 2026-06-17.