Executive brief
MQTT-C is a lightweight software library used by embedded devices and computers to communicate over the MQTT protocol. A vulnerability in how the library processes incoming messages allows a malicious or compromised message broker to crash the connected device or potentially view sensitive information stored in the device's memory. This could lead to service outages for IoT devices or the exposure of private data.
Technical details
A vulnerability exists in MQTT-C through version 1.1.6 within the `mqtt_unpack_publish_response()` function in `src/mqtt.c`. The function fails to adequately validate the `topic_name_size` against the `remaining_length` of the MQTT packet. An attacker controlling a broker or capable of injecting network traffic can send a crafted PUBLISH packet with a large `topic_name_size` (e.g., 0xFFFF), causing the parse pointer to advance beyond the receive buffer. This leads to an integer underflow when calculating `application_message_size`, resulting in a massive value being passed to `memmove()`. The exploit results in a heap-based out-of-bounds read, leading to a process crash (DoS) and potential disclosure of adjacent heap memory.
Affected products
- LiamBindle MQTT-C through 1.1.6
Timeline
- 2026-06-14: disclosed: CVE published to NVD