CVE-2026-54412: MQTT-C Heap-Based DoS Vulnerability

CVE-2026-54412 Overview

CVE-2026-54412 affects LiamBindle MQTT-C through version 1.1.6, an embedded MQTT client library written in C. The vulnerability resides in the mqtt_unpack_publish_response() function in src/mqtt.c and combines a heap-based out-of-bounds read [CWE-125] with an integer underflow [CWE-191]. A remote unauthenticated attacker who controls an MQTT broker, or who can inject MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.

Critical Impact
A single malicious PUBLISH packet can crash any MQTT-C client up to version 1.1.6 and may leak adjacent heap memory, breaking availability for IoT and embedded systems that subscribe to untrusted brokers.

Affected Products

LiamBindle MQTT-C library, all releases through version 1.1.6
Embedded and IoT applications that statically link MQTT-C as a client
Devices subscribing to MQTT brokers over unencrypted (non-TLS) sessions

Discovery Timeline

2026-06-14 - CVE-2026-54412 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54412

Vulnerability Analysis

The defect lives in mqtt_unpack_publish_response(), which decodes broker-to-client PUBLISH packets. The function validates only that the fixed-header remaining_length is at least 4 bytes. It then reads the 16-bit topic_name_size field directly from broker-controlled data and advances the parse pointer by that value. No check confirms that topic_name_size plus the surrounding protocol overhead fits within remaining_length.

After parsing the topic, the function computes application_message_size as remaining_length - topic_name_size - 2 for QoS 0 or - 4 for QoS greater than 0. The arithmetic is unsigned, so a small remaining_length paired with a large topic_name_size underflows toward 2^32. That underflowed length is then passed to memmove(), producing both an oversized copy and an out-of-bounds read from the receive buffer.

The vulnerability is classified as a network-reachable out-of-bounds read and integer underflow. The exploit precondition is subscription to an attacker-controlled or attacker-reachable MQTT broker.

Root Cause

The root cause is missing bounds validation between two adjacent header fields. The parser trusts topic_name_size without cross-checking it against remaining_length, and it performs the subsequent length calculation in unsigned arithmetic without an underflow guard. See the vulnerable line in the MQTT-C source on GitHub.

Attack Vector

An attacker sends a PUBLISH packet with topic_name_size = 0xFFFF and remaining_length = 7. The parser advances the read pointer 65535 bytes past the receive buffer, reading adjacent heap memory. The computed application_message_size wraps near 2^32, and the subsequent memmove() crashes the client process. Because MQTT-C is typically embedded in long-lived IoT firmware, this produces a reliable denial-of-service primitive against any subscribed device.

No verified public proof-of-concept code is available. The exploitation mechanism is described in prose above and in the referenced CWE-125 definition and CWE-191 definition.

Detection Methods for CVE-2026-54412

Indicators of Compromise

Unexpected crashes or restarts of MQTT-C client processes shortly after receiving a PUBLISH packet from a broker
MQTT PUBLISH frames where the 16-bit topic_name_size field exceeds the declared remaining_length minus protocol overhead
Inbound MQTT traffic containing topic_name_size = 0xFFFF paired with very small remaining_length values such as 7

Detection Strategies

Inspect MQTT traffic on TCP port 1883 and validate that topic_name_size + 2 (QoS 0) or + 4 (QoS greater than 0) does not exceed remaining_length
Deploy intrusion detection signatures that flag MQTT PUBLISH packets with malformed length fields
Correlate IoT device crash telemetry with preceding inbound MQTT broker traffic

Monitoring Recommendations

Log MQTT broker associations and alert when devices connect to brokers outside the approved allowlist
Monitor for repeated process exits or watchdog reboots on devices known to embed MQTT-C
Capture packet samples of malformed PUBLISH frames for offline analysis and signature development

How to Mitigate CVE-2026-54412

Immediate Actions Required

Inventory all firmware and applications that statically link LiamBindle MQTT-C and identify versions at or below 1.1.6
Restrict MQTT client connections to trusted brokers and require TLS to prevent traffic injection on unencrypted sessions
Place network controls between MQTT clients and untrusted brokers to filter malformed PUBLISH packets

Patch Information

At the time of NVD publication, no fixed release was listed for MQTT-C. Track the LiamBindle MQTT-C repository on GitHub for updates. Vendors that embed MQTT-C should apply a local patch that validates topic_name_size against remaining_length before advancing the parse pointer and that performs signed-arithmetic or pre-checked computation of application_message_size.

Workarounds

Enforce TLS (mqtts://, TCP port 8883) on all MQTT sessions to block packet injection by network attackers
Subscribe only to brokers under direct organizational control until a patched MQTT-C release is available
Add an upstream MQTT proxy or broker that validates PUBLISH length fields before forwarding traffic to embedded clients

bash

# Example: block plaintext MQTT egress and require TLS to approved brokers
iptables -A OUTPUT -p tcp --dport 1883 -j DROP
iptables -A OUTPUT -p tcp --dport 8883 -d broker.example.internal -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8883 -j DROP