Description
LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
Published: 2026-06-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Potential Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The latest CVE description confirms that MQTT‑C versions prior to 1.1.7 continue to have a heap‑based out‑of‑bounds read and integer underflow in the mqtt_unpack_publish_response() function. A remote unauthenticated attacker, such as a compromised broker or an entity injecting traffic into an unencrypted session, can send a single crafted PUBLISH packet that triggers a crash in the subscribed client and may expose adjacent heap memory. The flaw arises when the function processes the topic_name_size field without verifying that it fits within the remaining packet length, leading to an over‑read and potential information disclosure.

Affected Systems

Vendors: LiamBindle. Product: MQTT‑C. Affected versions: 1.1.6 and earlier.

Risk and Exploitability

CVSS score 7.8 indicates high severity. The EPSS score is extremely low (under 1%), implying a small chance of exploitation, yet the vulnerability can be trivially exercised by sending a malformed PUBLISH packet from a compromised or malicious broker, or by injecting traffic into an unencrypted MQTT session. Because the flaw is remote and unauthenticated, any subscriber to the broker may be affected. The vulnerability is not listed in CISA’s KEV catalog, but the nature of the bug suggests straightforward exploitation if the conditions are met.

Generated by OpenCVE AI on November 5, 2026 at 14:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • If an upgrade is not immediately possible, restrict the broker to only accept TLS‑encrypted connections to prevent unauthenticated injection of malformed packets.
  • Enable broker‑side packet validation or filtering to reject PUBLISH packets whose topic_name_size does not fit within the remaining_length, and monitor the client logs for out‑of‑bounds read attempts.
  • Check LiamBindle’s repository for newer releases that include a fix for mqtt_unpack_publish_response() and apply those updates.

Generated by OpenCVE AI on November 5, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
Description LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
References

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed. LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
Title MQTT-C - Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response() MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response() MQTT-C - Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Wed, 05 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Title MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Liambindle
Liambindle mqtt-c
Vendors & Products Liambindle
Liambindle mqtt-c

Mon, 15 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 14 Jun 2026 18:00:00 +0000

Type Values Removed Values Added
Description LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed.
Weaknesses CWE-125
CWE-191
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 7.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D'}

Subscriptions

Liambindle Mqtt-c
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-11-05T12:44:48.838Z

Reserved: 2026-06-13T16:39:46.122Z

Link: CVE-2026-54412

cve-icon Vulnrichment

Updated: 2026-06-15T17:01:11.558Z

cve-icon NVD

Status : Deferred

Published: 2026-06-14T18:17:20.750

Modified: 2026-11-05T13:17:07.963

Link: CVE-2026-54412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T15:00:19Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-191

    Integer Underflow (Wrap or Wraparound)