CVE-2026-54412: MQTT-C Heap-Based Out-of-Bounds Read and Integer Underflow Vulnerability (CVSS 8.2)

Summary

CVE-2026-54412 is a heap-based out-of-bounds (OOB) read vulnerability in MQTT-C, a lightweight C library implementing the MQTT protocol widely used in IoT and IIoT messaging. The flaw resides in the mqtt_unpack_publish_response() function in mqtt.c, where an integer underflow leads to reading beyond the bounds of a heap-allocated buffer. A remote attacker can exploit this by sending a crafted MQTT PUBLISH packet to a vulnerable client or broker, potentially leaking sensitive heap memory contents.

Technical Details

The vulnerability stems from an integer underflow in mqtt_unpack_publish_response(), the function responsible for decoding incoming MQTT PUBLISH packets. When processing a malformed or truncated PUBLISH message, the arithmetic used to calculate remaining payload lengths can wrap, resulting in the function attempting to read data well beyond the actual heap buffer’s valid range. This out-of-bounds read can expose adjacent heap memory to the attacker.

The issue is particularly dangerous because MQTT—Message Queuing Telemetry Transport—is the de facto messaging protocol for constrained IoT devices, industrial control systems (ICS), and smart infrastructure. A compromised client handling sensitive data (credentials, telemetry, sensor readings) could leak that data through a single malicious PUBLISH packet.