PT-2026-49135 · Liambindle · Mqtt-C
Saidakbarxon Maxsudxonov
·
Published
2026-06-14
·
Updated
2026-06-14
·
CVE-2026-54412
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt unpack publish response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining length is at least 4, then reads the 16-bit topic name size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic name size plus the surrounding overhead fits within remaining length; it subsequently computes application message size as remaining length - topic name size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic name size = 0xFFFF and remaining length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application message size near 2^32, crashing the process when the resulting memmove() is executed.
Fix
Integer Underflow
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mqtt-C