{"affected":[{"defaultStatus":"unknown","ecosystem":"https://github.com/LiamBindle/MQTT-C","product":"MQTT-C","source":"CNA: TuranSec","vendor":"LiamBindle","versions":[{"lessThan":"1.1.7","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.1.7","versionType":"semver"}]}],"cveId":"CVE-2026-54412","cwes":["CWE-125","CWE-191"],"description":"LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.","epss":{"date":"2026-11-04","percentile":0.35171,"score":0.00407},"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"CNA: TuranSec","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/V:D","version":"4.0"},{"score":8.2,"severity":"high","source":"CNA: TuranSec","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}],"modifiedAt":1793882688838,"publishedAt":1781457996740,"references":[{"source":"CNA: TuranSec","tags":["product"],"url":"https://github.com/LiamBindle/MQTT-C"},{"source":"CNA: TuranSec","tags":["product"],"url":"https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt.c#L1334"},{"source":"CNA: TuranSec","tags":["patch"],"url":"https://github.com/LiamBindle/MQTT-C/pull/208"},{"source":"CNA: TuranSec","tags":["release-notes","patch"],"url":"https://github.com/LiamBindle/MQTT-C/releases/tag/v1.1.7"},{"source":"CNA: TuranSec","tags":["technical-description"],"url":"https://cwe.mitre.org/data/definitions/125.html"},{"source":"CNA: TuranSec","tags":["technical-description"],"url":"https://cwe.mitre.org/data/definitions/191.html"}],"remediation":[{"kind":"fix","source":"CNA: TuranSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/LiamBindle/MQTT-C/pull/208"},{"kind":"fix","source":"CNA: TuranSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/LiamBindle/MQTT-C/releases/tag/v1.1.7"}],"revision":"e4e39e2e184be9e6810f5e6e74ca512d7ec7208c2efa9689a6d3eb66bbc0950b","sources":[{"modifiedAt":1793882688838,"name":"CNA: TuranSec","retrievedAt":1793884192221,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54412"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793884198729,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54412"}],"ssvc":{"assessedAt":1781542868771,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()","updatedAt":1793884198729}