aws-c-mqtt EUVD-2026-108508

Exploitation requires that the client application (a) uses the MQTT5-to-MQTT 3.1.1 compatibility adapter in aws-c-mqtt versions >= 0.9.1 and < 0.16.2, and (b) connects to an attacker-controlled broker, or an attacker can tamper with broker traffic on-path. Limiting factors confirmed by the vendor: connecting only to trusted brokers such as AWS IoT Core (which enforces the negotiated maximum packet size) prevents the oversized allocation, and using TLS prevents on-path tampering. Clients using a native MQTT5 or native MQTT 3.1.1 client instead of the compatibility adapter are not affected. Impact is limited to a crash of the client process (denial of service), which may recur on automatic restart/reconnect; there is no code execution, data exposure, or integrity impact.

This is a legitimate but bounded availability-only issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VA:H and both VC and VI at N confirms the sole impact is denial of service of the client process - no confidentiality or integrity loss. The base score of 8.2 (High) is driven largely by the network vector and unauthenticated reachability, but the AT:P flag (Attack Requirements: Present) is significant: exploitation is not against arbitrary targets but requires a specific precondition, namely that the vulnerable client connects to a malicious or on-path-tampered MQTT broker (the vendor's own workarounds confirm this - 'connect only to trusted brokers' and 'use TLS to prevent on-path tampering'). No EPSS score is provided in the input, and the CVE is NOT in CISA KEV; exploitation status is therefore no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a patchable, vendor-coordinated, availability-only flaw rather than an emergency. Net: this is a real, patch-worthy issue for anyone running the MQTT 3.1.1 compatibility adapter against untrusted brokers, but it is not a drop-everything event - the attacker-controlled-broker/on-path precondition and availability-only impact meaningfully cap real-world risk below what the raw 8.2 suggests. Note the AT:P requirement describes a precondition (malicious/on-path broker), not the internal trigger mechanism, which is not detailed in the available sources.

An IoT or application client built on aws-c-mqtt (via AWS CRT or the AWS IoT Device SDK for C++ v2) connects, using the MQTT 3.1.1 compatibility adapter, to a broker that an attacker controls or whose traffic an attacker can tamper with on-path. The attacker sends a crafted MQTT5 message that drives an excessive-size memory allocation (CWE-789) in the compatibility adapter, crashing the client process; if the application auto-restarts and reconnects, the crash can recur. No public exploit code is identified at time of analysis.