PT-2026-49135 · Liambindle · Mqtt-C
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
LiamBindle MQTT-C versions prior to 1.1.7
Description
A heap-based out-of-bounds read and integer underflow exist in the
mqtt unpack publish response() function within src/mqtt.c. A remote unauthenticated attacker who controls an MQTT broker or can inject traffic into an unencrypted session can cause a subscribed client to crash and potentially disclose adjacent heap memory by sending a crafted PUBLISH packet. The issue occurs because the function fails to verify that the topic name size field, read from the packet, plus overhead fits within the remaining length of the fixed-header. This leads to an integer underflow when calculating application message size using unsigned arithmetic, which is then passed to memmove(). For example, a packet with topic name size set to 0xFFFF and remaining length set to 7 causes the parse pointer to advance 65535 bytes beyond the receive buffer and results in an application message size near 2^32, crashing the process.Recommendations
Update to a version later than 1.1.6.
As a temporary workaround, restrict access to the
mqtt unpack publish response() function or avoid connecting to untrusted MQTT brokers until a patch is applied.Exploit
Fix
Out of bounds Read
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mqtt-C