The vulnerability exists in rabbitmq-c versions before 0.16.0 where the library accepts an undersized frame_max value from a malicious AMQP server during the amqp_login() process. This value is used to reallocate the outbound buffer without enforcing a minimum frame size, causing an immediate serialization to write beyond the allocated heap buffer. This heap-based buffer overflow results in memory corruption and likely denial of service. An attacker on the network path can exploit this against plaintext AMQP traffic. Although code execution is theoretically possible, no proof of concept has been demonstrated. The flaw is addressed by updating to version 0.16.0.

Exploitation of this vulnerability can lead to memory corruption and denial of service in applications using affected versions of rabbitmq-c. An attacker controlling or intercepting AMQP traffic can trigger the overflow by sending a crafted undersized frame_max value. While denial of service is likely, remote code execution remains theoretical and unproven.

Upgrade rabbitmq-c to version 0.16.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.16.0.