Is CVE-2026-5857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5857 being exploited in the wild.

How severe is CVE-2026-5857?

High severity, with a CVSS score of 8.1, published 6 August 2026.

Which products and versions are affected?

Contiki-NG prior to commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d (2026-07-10).

Is there a fix for CVE-2026-5857?

A patch was published on 2026-07-10: Fix merged in PR #3163 (mqtt: harden TCP input parsing against malformed and coalesced packets) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5857 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-5857?

Check whether you run Contiki-NG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5857: Contiki-NG MQTT client buffer overflow in topic parsing

CVE-2026-5857 · Severity: high · CVSS 8.1 · Published 2026-08-06

Contiki-NG is an operating system for IoT embedded devices. Its MQTT client contains a buffer overflow vulnerability where malformed MQTT messages with oversized topic names can corrupt adjacent memory structures and enable remote code execution on IoT devices. An attacker with network access to the MQTT broker can exploit this to take control of connected devices or extract sensitive data.

Technologies: Contiki-NG. Vendors: Contiki-NG.

Quick answers

Is CVE-2026-5857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5857 being exploited in the wild.
How severe is CVE-2026-5857?: High severity, with a CVSS score of 8.1, published 6 August 2026.
Which products and versions are affected?: Contiki-NG prior to commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d (2026-07-10).
Is there a fix for CVE-2026-5857?: A patch was published on 2026-07-10: Fix merged in PR #3163 (mqtt: harden TCP input parsing against malformed and coalesced packets) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5857 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-5857?: Check whether you run Contiki-NG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in parse_publish_vhdr() within os/net/app-layer/mqtt/mqtt.c. The parser prematurely sets a topic_len_received flag before validating the topic length against a 64-byte limit, causing the validation guard to be skipped on subsequent TCP segments. When a new segment arrives, the parser re-invokes with the persisted flag set, skipping the length-reading block and falling through to an unguarded memcpy() that uses an unvalidated 16-bit topic_len value as the copy size. This overwrites the 65-byte topic[] buffer into adjacent struct fields including payload_chunk pointers. Contiki-NG's MQTT implementation does not support TLS, leaving connections plaintext and vulnerable to man-in-the-middle exploitation by a compromised or attacker-controlled broker. The arbitrary-pointer-write primitive can lead to information disclosure, denial of service, or remote code execution on memory-unprotected embedded targets.

Affected products

Contiki-NG Contiki-NG prior to commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d (2026-07-10)

Timeline

2026-08-06: disclosed: Advisory published
2026-07-10: patched: Fix merged in PR #3163 (mqtt: harden TCP input parsing against malformed and coalesced packets)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.