MQTT Library CVE-2026-52048

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

8.2 HIGH

Network-reachable parser, no auth assumed for typical MQTT broker; high availability impact from crash, low confidentiality from potential OOB read; integrity unconfirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:18 vuln.today

DescriptionCVE.org

[MQTT v5 properties bounds check uses relative offset against absolute position]

AnalysisAI

Incorrect bounds checking in an MQTT v5 property parser uses a relative offset against an absolute buffer position, which can lead to out-of-bounds memory access. The affected component is an MQTT v5 implementation reported via Ubuntu's vendor channel. Without CVSS data or a vendor advisory with version specifics, the full exploit impact - whether read, write, or crash - cannot be confirmed from available data alone.

Technical ContextAI

MQTT v5 introduced an extended properties mechanism where variable-length fields are prefixed with a property length indicator. A correct bounds check must compare the remaining buffer space (absolute end minus current position) against the next field's length. This vulnerability arises when the bounds check mistakenly uses a relative offset value as if it were an absolute buffer position, or vice versa - a classic off-by-one or pointer arithmetic error (likely CWE-193 or CWE-125 class). The result is that a crafted MQTT CONNECT, PUBLISH, or other properties-bearing packet could cause the parser to read or write beyond the allocated buffer. No CPE string or CWE identifier was provided in the source data.

Affected ProductsAI

The affected product is an MQTT v5 protocol implementation, reported through Ubuntu's vendor security channel. No CPE string, exact package name, upstream library name, or affected version range was included in the available intelligence. Defenders should monitor Ubuntu Security Notices (USN) and the upstream MQTT library's advisory channel for version-specific guidance.

RemediationAI

No patch version or vendor advisory URL was provided in the available data. Patch available per vendor advisory should be assumed once Ubuntu publishes a USN for this issue - monitor https://ubuntu.com/security/notices for updates. As a compensating control until a patch is applied, restrict MQTT broker access to trusted clients using firewall rules or broker-level ACLs, and disable MQTT v5 protocol support if the broker configuration allows downgrading to MQTT v3.1.1, which does not use the extended properties mechanism where this flaw exists. Disabling v5 may break clients that depend on v5-specific features such as topic aliases or subscription identifiers - assess compatibility before applying. No patch version has been independently confirmed from the available data.