NanoMQ CVE-2025-59947

This is a genuinely high-severity issue carrying a vendor-assigned CVSS 4.0 base score of 8.5 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P with vulnerable-system impacts VC:L/VI:H/VA:H and subsequent-system SI:H/SA:H), indicating a network-reachable memory-corruption bug with high integrity and availability impact. The attack vector is network (AV:N) and complexity is low (AC:L), but PR:L means the attacker must hold at least low-level (authenticated) MQTT access, and UI:P indicates a passive dependency on a legitimate subscriber being present - both of which temper the raw score. Exploitation status is 'no public exploit identified at time of analysis': no EPSS probability, no CISA KEV listing, and no POC were provided in the intelligence, so there is no evidence of active or at-scale exploitation. The root cause is independently corroborated by the vendor commit diff (an under-sized cvector_grow allocation for msg_infos in pub_handler.c), which raises confidence this is a real, reproducible buffer overflow rather than a theoretical one. Net: treat as a real patch priority for anyone running NanoMQ with shared subscriptions enabled, but it is not a drop-everything internet-wide emergency given the authentication requirement, the specific dual-subscription trigger condition, and the absence of any exploitation signal. Note: EPSS is absent (not low) - scarcity of exploit data reflects a niche product, not confirmed low risk.