NanoMQ MQTT Broker contains a flaw in the MQTT v5 Variable Byte Integer parsing routine get_var_integer(). The routine accepts up to five-byte varints without bounds checks, causing an out‑of‑bounds read when a malformed payload is processed. The vulnerability leads to an application crash (identified when built with Address Sanitizer). This results in a denial of service that can interrupt broker availability.

The affected vendor is nanomq, product NanoMQ MQTT Broker. All releases up to and including version 0.24.6 are vulnerable. Users should ensure they run a version newer than 0.24.6.

CVSS score is 7.5, indicating moderate to high severity. EPSS score is under 1%, showing low immediate exploit probability. The vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered via malicious MQTT v5 traffic containing an oversized variable byte integer, implying a remote exploitation path and the primary risk being service disruption.