---
id: CVE-2026-54412
title: >-
  LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds
  read and integer underflow in the mqtt_unpack_publish_response function in
  src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT
  broker - …
summary: >-
  LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds
  read and integer underflow in the mqtt_unpack_publish_response function in
  src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT
  broker - …
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
  - CWE-191
published: '2026-06-14'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54412'
references:
  - url: 'https://cwe.mitre.org/data/definitions/125.html'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://cwe.mitre.org/data/definitions/191.html'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/LiamBindle/MQTT-C'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt.c#L1334'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
tags:
  - nvd
epss: 0.00717
epssPercentile: 0.51915
ingestedAt: '2026-08-10T12:39:46.807Z'
---

## Overview

LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.