CVE-2026-54412 is a heap-based out-of-bounds read and integer underflow vulnerability in LiamBindle MQTT-C through version 1.1.6. The mqtt_unpack_publish_response() function validates only that the fixed-header remaining_length is at least 4, then reads a 16-bit topic_name_size from the broker-controlled packet. It advances the parse pointer by topic_name_size without verifying that topic_name_size plus overhead fits within remaining_length. It then calculates application_message_size as remaining_length minus topic_name_size minus 2 or 4, using unsigned arithmetic, causing an integer underflow. This underflow leads to a memmove() with an excessively large size, causing a crash and potential disclosure of adjacent heap memory. An attacker can trigger this by sending a crafted PUBLISH packet with topic_name_size set to 0xFFFF and remaining_length set to 7.

A remote unauthenticated attacker who controls an MQTT broker or can inject MQTT traffic into an unencrypted session can crash the MQTT-C client and potentially read adjacent heap memory. This can lead to denial of service and information disclosure. The vulnerability does not require authentication and can be triggered remotely via network access to the MQTT client.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid using MQTT-C in unencrypted sessions or with untrusted MQTT brokers to reduce exposure. Monitor vendor communications for updates on remediation.