A race condition exists in EMQX's QoS 2 PUBLISH packet handling module, where a specific function in emqx_persistent_session_ds.erl can be manipulated to execute concurrently in an unexpected order. This flaw can result in duplicate processing of messages, state corruption, or inconsistent session handling, and is categorized under CWE‑362. The vulnerability is exploitable from remote connections and requires significant effort to trigger successfully, reflected in a high complexity and difficult exploitability rating.

EMQX, all versions up to and including 6.2.0 are affected. Users of the EMQX MQTT broker should verify that their deployment is not running a vulnerable version and plan to upgrade beyond 6.2.0.

The CVSS score of 2.3 indicates low severity, and the publicly disclosed exploit is considered difficult, with no current evidence of widespread use. Attackers could remotely craft QoS 2 PUBLISH packets to trigger the race, but the exploit is not trivial and has not been weaponized in known campaigns. The vulnerability is not listed in the CISA KEV catalog.