Executive brief
coreMQTT is a lightweight software library used by embedded and IoT devices to communicate with messaging servers. A flaw in how the library handles specific messages from a server allows a malicious or compromised broker to crash the device. This results in a denial of service, potentially disrupting the operations of industrial or consumer smart devices.
Technical details
A heap-based out-of-bounds read vulnerability exists in the MQTT v5.0 property parser of coreMQTT. The issue is rooted in missing bounds validation when processing SUBACK and UNSUBACK packets. A remote, unauthenticated MQTT broker can exploit this by sending a specially crafted packet to a client device using the vulnerable library. Successful exploitation can lead to a denial of service (system crash) or potentially the disclosure of adjacent heap memory. The vulnerability is fixed in version 5.0.1.
Affected products
- FreeRTOS coreMQTT v5.0.0
Timeline
- 2026-03-27: patched: Release v5.0.1 published on GitHub
- 2026-05-14: advisory: AWS Security Bulletin published
- 2026-05-15: disclosed: NVD and GitHub Advisory published