NanoMQ CVE-2025-59946

Exploitation requires network reachability to the NanoMQ broker's MQTT listener and the ability to perform subscription operations (subscribe/unsubscribe), so an active MQTT client session is needed - per CVSS PR:L this is treated as authenticated, though NanoMQ deployments that permit anonymous connections would remove that barrier. The core limiting factor is the data-race nature (CVSS AC:H): the attacker must win a concurrent timing window on the sub-info list, making the trigger nondeterministic and reducing reliability. Affected deployments are NanoMQ versions prior to 0.24.2; upgrading to 0.24.2 removes the condition entirely.

Signals are moderate and partly conflicting. The published CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) claims full confidentiality, integrity AND availability impact, but the description, the CWE-416 classification, and the vendor tags ('Denial Of Service', 'Use After Free', 'Memory Corruption') all describe a heap use-after-free that produces a crash - i.e. an availability loss, not confirmed data disclosure or code execution. This C:H/I:H appears to be a conservative over-rating of UAF's theoretical RCE potential; treat the realistic impact as a remotely triggerable broker crash unless the vendor confirms exploitable memory corruption. AC:H is significant: the flaw is a classic data race on the subscription-info list, so exploitation depends on winning a timing window rather than a deterministic trigger, which lowers reliability. Publicly available exploit/reproduction material exists (the GitHub issue), but the CVE is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - this reads as a real but non-urgent availability bug, not a drop-everything priority. PR:L per the vector implies an authenticated/connected MQTT client is required; note that many MQTT brokers permit anonymous connections by default, which could effectively lower that barrier, but authentication requirements should be verified against the deployment's config.

An attacker who can open MQTT connections to a NanoMQ broker (version < 0.24.2) repeatedly subscribes and unsubscribes from topics across concurrent sessions to race accesses to the shared subscription-info list. Winning the race frees a structure still referenced elsewhere, dereferencing dangling memory and crashing the broker, cutting off messaging for all connected edge/IoT clients. Public reproduction material is referenced in the vendor's GitHub issue #1863, though the race condition (AC:H) makes reliable triggering nondeterministic.