CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

The vulnerability identified as CVE-2026-115417 exists in the aws-c-mqtt library, specifically in the MQTT 3.1.1 compatibility adapter. It involves a memory allocation with an excessive size value (CWE-789), which under certain conditions can be triggered remotely to cause a denial of service of the client process. The affected versions are >=0.9.1 and <0.16.2. This library is part of the AWS Common Runtime and bundled in the AWS IoT Device SDK for C++ v2. No detailed technical exploitation or patch information is provided in the bulletin.

A remote attacker could exploit this vulnerability to cause a denial of service by triggering excessive memory allocation in the MQTT 3.1.1 compatibility adapter, leading to client process disruption. There is no indication of code execution or data compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of aws-c-mqtt versions >=0.9.1 and <0.16.2 should monitor AWS Security Bulletins for updates and apply any official fixes once available.