The issue resides in CocoaMQTT's packet parsing logic for MQTT 5.0. By publishing a 4‑byte malformed payload with the RETAIN flag, an attacker—either a compromised broker or malicious broker operator—forces the client to receive a corrupted packet. When the client decodes the packet, the application crashes immediately, even when running in the background. The crash effectively locks out the user until the retained message is removed from the broker, resulting in a persistent denial of service.

CocoaMQTT – a Swift‑based MQTT 5.0 client for iOS, macOS, and tvOS – is affected. Versions prior to 2.2.2 from the emqx product line are vulnerable. The client applications built against these versions should be considered at risk until the library is upgraded.

The CVSS score of 5.7 indicates moderate severity. Although EPSS data is unavailable and the vulnerability is not listed in KEV, the exploit is straightforward: any entity that can publish to a broker that the client subscribes to can trigger the crash. An attacker only needs to send a malformed 4‑byte payload with the RETAIN flag set, which is executed automatically by the broker. The risk is amplified when the broker is controlled by an adversary, as the malicious message will be pushed to all subscribing clients, leading to widespread application downtime.