The vulnerability in Contiki-NG's MQTT client arises because the parse_publish_vhdr() function sets a flag (topic_len_received) before validating the topic length against the 64-byte limit. If the topic length is over the limit, the function returns early but leaves the flag set. When the next TCP segment is processed, the parser skips the length validation block due to the persisted flag and directly performs a memcpy() using the unvalidated 16-bit topic length. This causes a buffer overflow in the 65-byte topic buffer, overwriting adjacent struct fields including a pointer used later by MQTT code. This gives an attacker controlling the broker an arbitrary pointer write primitive. The lack of TLS means the connection is plaintext, increasing exposure. The impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.

An attacker controlling the MQTT broker can exploit this vulnerability to perform an arbitrary pointer write on the client device. This can lead to information disclosure, denial of service, or remote code execution on embedded devices running Contiki-NG's MQTT client. The plaintext nature of the connection (no TLS support) increases the risk of interception and exploitation. The vulnerability is critical with a CVSS score of 8.1, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting Contiki-NG MQTT clients to untrusted or attacker-controlled brokers. Consider network-level protections to restrict broker access. Monitor vendor channels for patches or updates addressing this vulnerability.