Description
LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
Published: 2026-06-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MQTT‑C versions up to 1.1.6 contain a heap‑based out‑of‑bounds read and integer underflow in the mqtt_unpack_publish_response() function. An unauthenticated remote attacker who controls an MQTT broker or can inject traffic into an unencrypted session can send a single crafted PUBLISH packet that triggers a crash in the subscribed client and may expose adjacent heap memory. The flaw arises when the function processes the topic_name_size field without checking that it fits within the remaining packet length, leading to a large over‑read and potential information disclosure.

Affected Systems

Vendors: LiamBindle. Product: MQTT‑C. Affected versions: 1.1.6 and earlier.

Risk and Exploitability

CVSS score 7.8 indicates high severity. The EPSS score is approximately 0.4%, indicating a very low probability of exploitation, but the vulnerability can still be trivially exercised by sending a single malformed PUBLISH packet from a compromised or malicious broker, or by injecting traffic into an unencrypted MQTT session. Because the flaw is remote and does not require authentication, any subscriber to the broker could be affected. The vulnerability is not yet listed in CISA’s KEV catalog, but the nature of the bug suggests that exploitation would be straightforward and could be automated by a broker administrator or attacker with network visibility.

Generated by OpenCVE AI on August 11, 2026 at 00:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • If an upgrade is not immediately possible, restrict the broker to only accept TLS‑encrypted connections to prevent unauthenticated injection of malformed packets.
  • Enable broker‑side packet validation or filtering to reject PUBLISH packets whose topic_name_size does not fit within the remaining_length, and monitor the client logs for out‑of‑bounds read attempts.
  • Check LiamBindle’s repository for newer releases that include a fix for mqtt_unpack_publish_response() and apply those updates.

Generated by OpenCVE AI on August 11, 2026 at 00:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed. LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
Title MQTT-C - Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response() MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response() MQTT-C - Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Wed, 05 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Title MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Liambindle
Liambindle mqtt-c
Vendors & Products Liambindle
Liambindle mqtt-c

Mon, 15 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 14 Jun 2026 18:00:00 +0000

Type Values Removed Values Added
Description LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed.
Weaknesses CWE-125
CWE-191
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 7.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D'}

Subscriptions

Liambindle Mqtt-c
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:43:58.406Z

Reserved: 2026-06-13T16:39:46.122Z

Link: CVE-2026-54412

cve-icon Vulnrichment

Updated: 2026-06-15T17:01:11.558Z

cve-icon NVD

Status : Deferred

Published: 2026-06-14T18:17:20.750

Modified: 2026-08-10T12:17:17.240

Link: CVE-2026-54412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T00:15:04Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-191

    Integer Underflow (Wrap or Wraparound)