{"id":"CVE-2026-54412","aliases":["EUVD-2026-36663","GHSA-28cw-rpqc-wqqj"],"status":"published","title":"MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()","description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","severity":{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0043,"percentile":0.37724,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-191"],"published":"2026-06-14T17:26:36Z","modified":"2026-11-05T21:32:25Z","products":[{"vendor":"liambindle","product":"mqtt-c"}],"references":[{"url":"https://github.com/LiamBindle/MQTT-C","tags":["product","package"]},{"url":"https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt.c#L1334","tags":["product","web"]},{"url":"https://github.com/LiamBindle/MQTT-C/pull/208","tags":["patch","fix"]},{"url":"https://github.com/LiamBindle/MQTT-C/releases/tag/v1.1.7","tags":["release-notes","patch","fix"]},{"url":"https://cwe.mitre.org/data/definitions/125.html","tags":["technical-description","article"]},{"url":"https://cwe.mitre.org/data/definitions/191.html","tags":["technical-description","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54412","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-28cw-rpqc-wqqj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54412.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54412","title":"MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()","description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","status":"published","published":"2026-06-14T17:26:36.74Z","modified":"2026-11-05T12:44:48.838Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-05T16:36:34.343037Z"}],"euvd":[{"id":"EUVD-2026-36663","description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","status":"published","published":"2026-06-14T17:26:36Z","modified":"2026-11-05T12:44:48Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D","level":"high"}],"updated_at":"2026-11-05T16:59:58.403219Z"}],"ghsa":[{"id":"GHSA-28cw-rpqc-wqqj","title":"LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer...","description":"LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet. The function validates only that the fixed-header remaining_length is at least 4, then reads the 16-bit topic_name_size field from the broker-controlled packet and advances the parse pointer by that value without verifying that topic_name_size plus the surrounding overhead fits within remaining_length; it subsequently computes application_message_size as remaining_length - topic_name_size - 2 (QoS 0) or - 4 (QoS greater than 0) in unsigned arithmetic, producing an integer underflow that is then passed to memmove(). A PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7 advances the parse pointer 65535 bytes past the receive buffer (out-of-bounds read) and causes an application_message_size near 2^32, crashing the process when the resulting memmove() is executed.","status":"published","published":"2026-06-14T18:32:36Z","modified":"2026-11-05T15:34:17Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T16:36:50.741706Z"}],"nvd":[{"id":"CVE-2026-54412","description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","status":"published","published":"2026-06-14T18:17:20.75Z","modified":"2026-11-05T13:17:07.963Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-05T19:55:55.702046Z"}],"osv":[{"id":"CVE-2026-54412","title":"MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()","description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","status":"published","published":"2026-06-14T17:26:36.74Z","modified":"2026-11-07T02:48:35.55297582Z","cvss":[{"version":"4.0","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D","level":"high"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-07T03:08:07.221269Z"}]}}