CVE-2026-54412: MQTT-C Heap Read and Integer Underflow – Remote Denial of Service

Technical summary

CVE-2026-54412 is a heap-based out-of-bounds read vulnerability combined with integer underflow in the mqtt_unpack_publish_response() function (src/mqtt.c) of MQTT-C. The flaw stems from inadequate bounds checking when parsing MQTT PUBLISH packets. The code validates that remaining_length ≥ 4 but fails to verify that the attacker-controlled topic_name_size field, when added to packet overhead (2 or 4 bytes depending on QoS), remains within the remaining_length boundary. This allows the parse pointer to advance arbitrarily far beyond the receive buffer. Subsequently, application_message_size is computed as (remaining_length - topic_name_size - 2/4) in unsigned integer arithmetic, which underflows when topic_name_size exceeds remaining_length, producing a near-maximum 32-bit value. This oversized value is then passed to memmove(), triggering a crash or memory disclosure. Proof-of-concept: a PUBLISH packet with topic_name_size=0xFFFF and remaining_length=7 advances the parser 65535 bytes out-of-bounds and computes application_message_size near 2^32.

Business impact

Organizations deploying MQTT-C clients face denial-of-service risk. Any application using MQTT-C to subscribe to topics on an MQTT broker is vulnerable to sudden, uncontrolled crashes triggered by a single remote packet. In operational technology (OT), industrial IoT, or real-time monitoring environments, this can disrupt critical message flow and system availability. The memory disclosure aspect creates a secondary risk: sensitive data resident in adjacent heap memory (cryptographic keys, connection tokens, application secrets) could be read and exfiltrated. For organizations integrating MQTT-C into embedded or resource-constrained systems, repeated crash-and-restart cycles can accelerate hardware wear and complicate compliance and audit trails.

Affected systems

All applications and devices embedding LiamBindle MQTT-C library versions up to and including 1.1.6 are vulnerable. This includes end-user MQTT client applications, embedded IoT devices, and middleware components that depend on MQTT-C for publish/subscribe functionality. Risk is highest for deployments on untrusted networks or where the MQTT broker itself is compromised or publicly accessible. Systems with encrypted MQTT connections (TLS/mTLS) are also vulnerable to this packet-parsing flaw, as the vulnerability operates at the protocol level after decryption.

Exploitability

Exploitability is high. The attack requires network access to send a crafted MQTT PUBLISH packet to a vulnerable client, but no authentication, no user interaction, and no client-side complexity. An attacker must either (1) control the MQTT broker, (2) perform a man-in-the-middle attack on an unencrypted connection, or (3) already be on the network path. The simplicity of the malformed packet and the deterministic nature of the crash make this trivial to weaponize. However, the attack surface is limited to environments where MQTT-C clients are actively subscribed to topics; one-time publishers are not affected.

Remediation

Immediately upgrade MQTT-C to a patched version released after 1.1.6. Verify the exact patched version in the official LiamBindle MQTT-C repository and release notes. In the interim, implement network-level mitigations: isolate MQTT brokers behind firewalls, enforce TLS encryption for all MQTT connections, use strong authentication and access controls on brokers, and monitor for abnormal packet patterns or client crashes. Applications should also implement restart logic and circuit-breaker patterns to gracefully handle unexpected crashes.

Patch guidance

Check the LiamBindle MQTT-C GitHub repository for a release issued after June 2026 that explicitly addresses CVE-2026-54412. The fix should include proper bounds validation in mqtt_unpack_publish_response() to ensure topic_name_size plus overhead does not exceed remaining_length before advancing the parse pointer, and safe integer arithmetic to prevent underflow. Verify the patch against the vendor's official security advisory before deploying. For embedded systems, test the patched library thoroughly in your specific environment before rolling out to production, as MQTT is often mission-critical.

Detection guidance

Monitor MQTT brokers and clients for signs of exploitation: (1) unexpected client disconnections or crashes correlated with specific PUBLISH packets; (2) malformed MQTT packets with topic_name_size close to 0xFFFF or remaining_length unusually small relative to the payload; (3) spike in memory access violations or segmentation faults in MQTT-C-dependent processes. Implement packet inspection at the network level to identify PUBLISH messages with suspicious remaining_length/topic_name_size ratios. Enable verbose logging in MQTT clients to capture parse errors or buffer boundary warnings. Correlate client crash dumps with MQTT broker logs to identify the triggering packet.

Why prioritize this

This vulnerability warrants immediate prioritization due to the combination of high CVSS (8.2), unauthenticated remote exploitability, and deterministic denial-of-service impact. Unlike many memory corruption flaws that require precise exploitation, this one is trivial to trigger and will reliably crash any vulnerable subscriber. The potential for heap memory disclosure further elevates risk in environments handling sensitive data. Organizations running MQTT-C should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects attack vector (network), low attack complexity, no privileges or user interaction required, and impacts to both confidentiality (memory disclosure) and availability (crash). The score does not account for scope of impact—a single MQTT-C client crash may cascade to dependent systems—or the widespread deployment of MQTT in IoT ecosystems. In risk-prioritization frameworks, this should be treated as critical in any environment where MQTT-C underpins operational or availability-sensitive functions.

Frequently asked questions