This vulnerability involves a race condition in EMQX's QoS 2 PUBLISH Packet Handler, specifically within an unknown function in the emqx_persistent_session_ds.erl file. It affects EMQX versions 6.0, 6.1, and 6.2.0. The race condition could potentially be triggered remotely, but the attack complexity is high and exploitability is difficult. The CVSS 4.0 vector indicates network attack vector with high complexity and low privileges required, resulting in low impact. No official patch or remediation guidance has been published by the vendor as of now.

The impact is assessed as low severity with a CVSS score of 2.3. The vulnerability could allow a remote attacker to cause a race condition in the affected component, but exploitation is difficult and requires high complexity. There are no reports of active exploitation in the wild. The vulnerability does not appear to allow privilege escalation, user interaction, or confidentiality/integrity/availability violations beyond the race condition itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should monitor vendor communications for updates. Given the low severity and high complexity of exploitation, immediate emergency action is not indicated, but affected users should plan to update once a patch is available.