EUVD-2026-36663
GHSA-28cw-rpqc-wqqj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X
AC:H reflects that exploitation requires controlling the victim's MQTT broker or achieving MitM network position - neither is trivial opportunistic access.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed.
AnalysisAI
Heap-based out-of-bounds read and integer underflow in LiamBindle MQTT-C (all versions through 1.1.6) allows a remote attacker who controls an MQTT broker - or who can inject packets into an unencrypted MQTT session - to crash any subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single specially crafted PUBLISH packet. The flaw resides in mqtt_unpack_publish_response() in src/mqtt.c, where the broker-supplied 16-bit topic_name_size field is used to advance a parse pointer without validating it fits within the packet's remaining_length, and the subsequent unsigned subtraction to derive application_message_size wraps to near 2^32 and is passed directly to memmove(). No patched release has been identified at time of analysis; a proof-of-concept is indicated by the CVSS 4.0 E:P supplemental metric, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
MQTT-C (CPE: cpe:2.3:a:liambindle:mqtt-c:*:*:*:*:*:*:*:*) is a portable C implementation of the MQTT 3.1.1 protocol widely embedded in IoT firmware and resource-constrained devices. The vulnerable function mqtt_unpack_publish_response() at src/mqtt.c line 1334 (v1.1.6) deserializes PUBLISH control packets sent by the broker to subscribed clients. Two interacting weaknesses are present. First, CWE-125 (Out-of-Bounds Read): the function checks only that remaining_length is at least 4, then reads the broker-controlled 16-bit topic_name_size field and unconditionally advances the parse pointer by that full value - without checking that topic_name_size plus its two-byte length prefix fits inside the packet boundary. With topic_name_size set to 0xFFFF and remaining_length set to 7, the pointer advances 65,535 bytes beyond the receive buffer into adjacent heap memory. Second, CWE-191 (Integer Underflow): application_message_size is computed as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS > 0) using C unsigned integer arithmetic; when topic_name_size exceeds remaining_length minus overhead the subtraction wraps, producing a value approaching 2^32. That underflowed size is passed unguarded to memmove(), triggering a process crash. The fix class is straightforward: a pre-validation guard such as 'if (topic_name_size + 2 > remaining_length) return error' before any arithmetic would prevent both codepaths.
RemediationAI
No vendor-released patched version of MQTT-C has been identified at time of analysis; the available references link only to the upstream repository at https://github.com/LiamBindle/MQTT-C and the specific vulnerable source line, with no associated fix commit, patch advisory, or tagged release. Developers embedding MQTT-C should apply a manual source-level fix to mqtt_unpack_publish_response() in src/mqtt.c: add a bounds validation check immediately after reading topic_name_size that returns a parse error if topic_name_size + 2 (QoS 0) or topic_name_size + 4 (QoS > 0) exceeds remaining_length, before any pointer arithmetic or application_message_size computation. Monitor the upstream repository for an official fix release. As compensating controls pending a patch: first, enforce TLS for all MQTT broker connections to eliminate the traffic-injection vector entirely - clients using TLS cannot have PUBLISH packets injected by a network-positioned attacker, though this does not protect against a compromised or malicious legitimate broker; second, restrict client connections to known, authenticated brokers using mutual TLS or pre-shared key authentication, substantially reducing the broker-control attack surface - note that this requires changes to client and broker configuration and may not be feasible for devices connecting to public brokers; third, run MQTT-C client processes under OS-level process isolation, sandboxing, or watchdog supervision so that a crash is automatically detected and the service restarted, limiting the availability impact to a brief interruption rather than a persistent outage.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today