---
id: CVE-2026-54412
title: >-
  LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds
  read and integer underflow in the mqtt_unpack_publish_response function in
  src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT
  broker - …
summary: >-
  LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds
  read and integer underflow in the mqtt_unpack_publish_response function in
  src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT
  broker - …
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
  - CWE-191
published: '2026-06-14'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54412'
references:
  - url: 'https://cwe.mitre.org/data/definitions/125.html'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://cwe.mitre.org/data/definitions/191.html'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/LiamBindle/MQTT-C'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/LiamBindle/MQTT-C/blob/v1.1.6/src/mqtt.c#L1334'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/LiamBindle/MQTT-C/pull/208'
    label: Fix out-of-bounds read and integer underflow in PUBLISH parsing
  - url: 'https://github.com/LiamBindle/MQTT-C/releases/tag/v1.1.7'
    label: MQTT-C v1.1.7 release
tags:
  - nvd
  - cve.org
epss: 0.00407
epssPercentile: 0.35171
ingestedAt: '2026-08-10T12:39:46.807Z'
vendor: LiamBindle
product: MQTT-C
affected:
  - MQTT-C < 1.1.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-15T17:01:08.771614Z'
---

## Overview

LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.