CVE-2026-8686: FreeRTOS coreMQTT DOS Vulnerability

CVE-2026-8686 Overview

CVE-2026-8686 is a denial-of-service vulnerability in coreMQTT, the MQTT client library maintained by FreeRTOS. The flaw resides in the MQTT v5.0 property parser, which performs insufficient bounds validation when processing packets received from a broker. A malicious or compromised MQTT broker can send a crafted packet that triggers an out-of-bounds read [CWE-125], causing the client to crash or hang. The issue affects coreMQTT versions prior to 5.0.1 and is fixed in v5.0.1. Because coreMQTT is widely embedded in IoT and edge devices, the impact extends across constrained systems that rely on MQTT for telemetry and command channels.

Critical Impact
A remote MQTT broker can crash any connected coreMQTT v5.0.0 client by sending a single malformed v5.0 property field, with no authentication or user interaction required.

Affected Products

FreeRTOS coreMQTT 5.0.0
Embedded and IoT devices linking coreMQTT 5.0.0 as an MQTT v5.0 client
AWS IoT-connected devices using coreMQTT versions prior to 5.0.1

Discovery Timeline

2026-05-15 - CVE-2026-8686 published to the National Vulnerability Database (NVD)
2026-05-19 - Last updated in NVD database
2026-05-21 - EPSS score published at 0.028%, percentile 8.031

Technical Details for CVE-2026-8686

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the MQTT v5.0 property parser inside coreMQTT. MQTT v5.0 introduced a variable-length property section in many control packets, where each property is identified by an identifier byte and followed by a typed value such as a variable byte integer, two-byte integer, four-byte integer, UTF-8 string, or binary data.

The parser in coreMQTT 5.0.0 reads property fields without sufficiently validating that the declared length of each value remains within the bounds of the remaining packet buffer. When a broker sends a packet whose property length encodes a value extending past the end of the received buffer, the parser dereferences memory outside the allocated region. On constrained embedded targets, this typically results in a hard fault, watchdog reset, or task abort, producing a denial-of-service condition on the client.

Root Cause

The root cause is missing length validation in the property-parsing routines of coreMQTT prior to v5.0.1. The parser trusts length fields supplied by the remote peer and advances read pointers without confirming that each property value fits within the packet boundary. The fix in v5.0.1 adds the required bounds checks before each property field is consumed.

Attack Vector

The attack vector is network-based and unauthenticated from the client's perspective. Any MQTT broker that a coreMQTT client connects to can deliver the malicious packet inside a normal MQTT v5.0 control frame, such as CONNACK, PUBLISH, SUBACK, or DISCONNECT. An attacker who controls a broker, who can perform a machine-in-the-middle attack on an unencrypted MQTT session, or who has compromised an upstream broker can trigger the condition. No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is published. See the GitHub Security Advisory GHSA-6qh9-r6jp-2wxc and the AWS Security Bulletin 2026-032 for vendor-confirmed technical details.

Detection Methods for CVE-2026-8686

Indicators of Compromise

Unexpected resets, hard faults, or watchdog-triggered reboots on devices shortly after establishing an MQTT v5.0 session.
Repeated TCP reconnection attempts from IoT clients to an MQTT broker following receipt of broker-originated control packets.
MQTT v5.0 packets containing property length fields that exceed the remaining packet length on the wire.

Detection Strategies

Inventory firmware images and SBOMs for coreMQTT version strings matching 5.0.0 to identify exposed devices.
Inspect MQTT traffic at gateways or brokers for malformed v5.0 property sections where declared property value lengths exceed the packet's remaining length.
Correlate device crash telemetry and reconnect storms with broker identity and recent packet contents to identify clients impacted by malformed responses.

Monitoring Recommendations

Log and alert on abnormal MQTT client disconnect patterns, especially clusters of devices disconnecting from the same broker simultaneously.
Monitor broker-side metrics for connections originating from clients reporting coreMQTT/5.0.0 in their client identifier or user-agent fields.
Forward device-side fault logs to a centralized analytics or SIEM platform to detect crash patterns consistent with parser faults during MQTT property handling.

How to Mitigate CVE-2026-8686

Immediate Actions Required

Upgrade all devices and firmware images using coreMQTT 5.0.0 to coreMQTT v5.0.1 as published by FreeRTOS.
Restrict MQTT client connections to trusted broker endpoints only, using TLS with server certificate validation to prevent broker impersonation.
For AWS IoT customers, review the AWS Security Bulletin 2026-032 and apply the recommended SDK updates that incorporate the fixed library.

Patch Information

FreeRTOS released coreMQTT v5.0.1, which adds the missing bounds validation in the MQTT v5.0 property parser. Download details and release notes are available at the GitHub Release v5.0.1 page. Vendors integrating coreMQTT into device firmware should rebuild and re-sign images with the patched library, then deliver updates through their existing over-the-air or device-management channels.

Workarounds

Enforce mutual TLS between MQTT clients and brokers so that only authenticated, trusted brokers can deliver MQTT v5.0 packets to vulnerable clients.
Where feasible, configure clients to negotiate MQTT v3.1.1 instead of v5.0 until firmware containing coreMQTT v5.0.1 is deployed, since the vulnerable code path is in the v5.0 property parser.
Place MQTT brokers behind network controls that block untrusted inbound broker-to-client traffic and restrict client egress to known broker IPs and ports.

bash

# Configuration example: pin coreMQTT to the fixed version in a CMake-based build
# Replace any prior reference to coreMQTT 5.0.0 with v5.0.1
git -C libraries/coreMQTT fetch --tags
git -C libraries/coreMQTT checkout v5.0.1
grep -R "coreMQTT" CMakeLists.txt manifest.yml | grep -i "5\.0\.0"
# Rebuild and re-sign firmware after the dependency is updated