NanoMQ CVE-2026-35217

Exploitation requires that the attacker can establish a TCP connection to the NanoMQ MQTT broker listener and send a valid MQTT v5 CONNECT followed by a crafted MQTT v5 SUBSCRIBE packet. No authentication credentials are required (PR:N per CVSS). For the semantic-only impact (unauthorized subscription installation), the only condition is that the SUBSCRIBE packet omits the Subscription Options byte for one or more topic filters - this is achievable with any MQTT v5 client capable of sending raw packet bytes. For the availability impact (heap-buffer-overflow crash), the additional condition is that the total packet framing be constructed so that the missing Subscription Options byte position aligns with the real heap allocation boundary of the message buffer - this specific packet-length construction is the AC:H factor and limits reliable crash triggering to deliberate crafting. Exploitation is bounded by: network access to the MQTT port (non-default exposure if broker is behind a firewall), the AC:H requirement for the crash path, and the absence of any MQTT-level feature gating since SUBSCRIBE handling is always active.

The CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) accurately reflects the two-tiered risk profile. The High availability impact reflects the potential for a broker crash via heap-buffer-overflow, which would immediately disconnect all MQTT clients - a significant operational impact in IoT deployments where NanoMQ serves as the central message router. The Low integrity impact reflects the semantic variant, where a malformed subscription is silently installed, potentially causing messages to be delivered to unintended subscribers. AC:H is the critical limiting factor: reliably triggering the crash path requires specific packet-length construction such that the missing Subscription Options byte falls precisely at the real heap allocation boundary - this requires deliberate crafting rather than opportunistic fuzzing. The semantic variant (silent subscription installation) is achievable with lower precision and may represent a more accessible attack surface. No EPSS data is available for this CVE, and the vulnerability is absent from CISA KEV, indicating no confirmed automated or widespread exploitation. The AC:H designation and absence of known exploit code suggest the current risk is primarily from targeted or research-grade actors rather than commodity attack tooling. Confidentiality impact is correctly rated N - the 1-byte OOB read is consumed internally by the parser and not reflected back to the attacker.

An unauthenticated attacker with TCP access to the NanoMQ MQTT listener constructs an MQTT v5 SUBSCRIBE packet in which a subscription topic entry omits the mandatory 1-byte Subscription Options field, and sizes the total packet so that the parser's attempt to read the absent byte lands exactly at the end of the underlying heap allocation. Upon sending this packet, the broker's SUBSCRIBE parser performs a 1-byte out-of-bounds heap read, which may trigger a process crash - disrupting all MQTT clients connected to the broker and, in edge/IoT environments, halting dependent device telemetry pipelines. In the less-precisely-crafted variant, the broker silently installs the malformed subscription, causing unintended message routing without any visible error.