Memory allocation with an excessive size value in the MQTT 3.1.1 compatibility adapter of AWS aws‑c‑mqtt might allow a remote actor to cause a denial of service of the client application. The vulnerability arises from incorrect handling of size parameters during memory allocation, resulting in uncontrolled allocation that can exhaust system resources. This flaw is identified as CWE‑770 and CWE‑789, representing uncontrolled resource consumption and out‑of‑bounds write, respectively.

AWS aws‑c‑mqtt versions prior to 0.16.2 are affected, including any builds bundled within the AWS Common Runtime or AWS IoT Device SDK that contain an older version of the library.

Based on the description, it is inferred that a remote actor can craft a malicious MQTT packet that triggers the oversized allocation in the 3.1.1 compatibility adapter. The CVSS score of 8.2 indicates high severity; the EPSS score of <1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no widespread public exploit is known. The attack vector is remote, requiring network access to the MQTT endpoint, and the flaw does not provide privileged execution or local code execution, but can cause service disruption.