CVE-2026-54412 Details

A vulnerability in LiamBindle MQTT-C versions through 1.1.6 allows for a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function. This issue enables a remote, unauthenticated attacker, who controls an MQTT broker or can inject MQTT traffic into an unencrypted session, to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory. The vulnerability arises because the function only partially validates the fixed-header remaining_length before reading the topic_name_size field from the broker-controlled packet. This oversight allows an attacker to craft a PUBLISH packet that exploits the vulnerability by causing an out-of-bounds read and manipulating the application_message_size calculation, leading to a crash when the data is moved in memory.