A NULL pointer dereference occurs in the NanoMQ MQTT‑v5 client during CONNECT packet decoding, leading to a segmentation fault that terminates the client process. The flaw originates from iterating over CONNECT properties with the wrong variable, causing a dereference when a packet contains will properties but no connect‑level properties. The result is a single packet that can crash any connecting NanoMQ client. Because the crash is triggered by a malicious MQTT broker, the impact is a remote denial of service for the affected client.

Vendors and products affected are Nanomq’s NanoMQ implementation, specifically its nanomq_cli utility and the core bridge mode component that share the same mqtt_client.c receive path. All releases up to and including version 0.24.11 are vulnerable; no later releases are listed as unaffected in the available data.

The CVSS score of 2.6 indicates a low severity rating, and the EPSS score of <1% indicates a very low exploitation probability; the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote over the network, as a malicious MQTT broker can send the exploit packet to any client that connects to it. A single 35‑byte packet can force a crash, and if the client is configured to automatically reconnect, the crash can recur indefinitely, producing a persistent denial of service. No authentication or other check is described, so any client that accepts connections is potentially exposed.