{"id":"CVE-2026-54412","title":"LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - …","summary":"LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - …","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125","CWE-191"],"published":"2026-06-14","updated":"2026-08-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54412","references":[{"url":"https://cwe.mitre.org/data/definitions/125.html","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},{"url":"https://cwe.mitre.org/data/definitions/191.html","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},{"url":"https://github.com/LiamBindle/MQTT-C","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},{"url":"https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt.c#L1334","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"tags":["nvd"],"epss":0.00717,"epssPercentile":0.5175,"ingestedAt":"2026-08-10T12:39:46.807Z","slug":"CVE-2026-54412","body":"## Overview\n\nLiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}