CVE-2026-54412 is a heap-based out-of-bounds read and integer underflow vulnerability in the mqtt_unpack_publish_response function of LiamBindle MQTT-C through version 1.1.6. An attacker controlling an MQTT broker or able to inject MQTT traffic into an unencrypted session can send a specially crafted PUBLISH packet to cause a crash of the MQTT-C client and potentially leak adjacent heap memory. The vulnerability stems from improper bounds checking and integer handling in the MQTT message unpacking code.

Successful exploitation can cause a denial of service by crashing the MQTT-C client and may lead to disclosure of adjacent heap memory, potentially exposing sensitive information. The attack requires network access to the MQTT broker or the ability to inject traffic into an unencrypted MQTT session. No privilege or user interaction is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using unencrypted MQTT sessions or ensure that MQTT brokers are trusted and protected from unauthorized access or injection. Monitor vendor channels for updates and apply patches once released.