Threats tagged 'ghsa-28cw-rpqc-wqqj'

LiamBindle MQTT-C versions through 1.1.6 have a heap-based out-of-bounds read and integer underflow vulnerability in the mqtt_unpack_publish_response() function. A remote unauthenticated attacker controlling an MQTT broker or able to inject MQTT traffic into an unencrypted session can send a crafted PUBLISH packet to crash the client and potentially disclose adjacent heap memory. The flaw arises from improper validation of the topic_name_size field relative to the remaining_length, leading to an out-of-bounds read and a large memmove() operation causing a crash.