MQTT-C versions up to 1.1.6 contain a heap‑based out‑of‑bounds read and integer underflow in the mqtt_unpack_publish_response() routine. The function reads only the remaining_length field of a PUBLISH packet, then reads an unsigned topic_name_size value and advances the parsing pointer by that amount without verifying that the total size fits within the buffer. The subsequent unsigned arithmetic computing the application message size can underflow, producing a very large count that is passed to memmove(). A crafted packet containing a topic_name_size of 0xFFFF and a remaining_length of 7 causes the parser to read far beyond the received data and triggers a crash, giving the attacker a chance to read adjacent heap data. The impact is a denial‑of‑service crash and potential disclosure of memory contents in a subscribed client.

Vendors: LiamBindle. Product: MQTT‑C. Affected versions: 1.1.6 and earlier.

CVSS score 7.8 indicates high severity. The EPSS score is unavailable, but the vulnerability can be trivially exercised by sending a single malformed PUBLISH packet from a compromised or malicious broker, or by injecting traffic into an unencrypted MQTT session. Because the flaw is remote and does not require authentication, any subscriber to the broker could be affected. The vulnerability is not yet listed in CISA’s KEV catalog, but the nature of the bug suggests that exploitation would be straightforward and could be automated by a broker administrator or attacker with network visibility.