Contiki-NG’s MQTT client contains a parsing flaw that allows an attacker to craft a publish packet with a topic longer than the allowed 64-byte limit. The parser incorrectly handles the length field between TCP segments, resulting in an out-of-bounds write to the topic buffer and inadvertently overwriting a pointer in the message structure. This provides the attacker with an arbitrary-pointer-write primitive that can be leveraged to read or modify critical data, and ultimately execute arbitrary code on the target device.

The vulnerability affects all Contiki-NG implementations that use the current MQTT client code. The specific commit that introduced the issue is recorded in the project’s repository. Versions of Contiki-NG prior to the merge of the fix in pull‑request 3163 are susceptible; precise version ranges are not listed, so any build that includes the unpatched mqtt.c module is at risk.

The flaw is high severity, with a CVSS score of 9.2. No EPSS data is available and the vulnerability is not in the KEV catalog, but the lack of TLS and the embedded nature of the software mean that an attacker who can act as a broker or otherwise send crafted MQTT packets stands a strong chance of exploiting it. The attack vector is via plain‑text MQTT traffic and does not require privileged access to the device; as such, the risk is substantial for exposed or poorly isolated deployments.