rootpwn

high · CVSS v3 7.5 · CVSS v4 7

CVE-2026-73863

NanoMQ before version 0.24.14 contains a heap-based buffer over-read vulnerability in the MQTT v5 subscription information decoding function

Overview

NanoMQ before version 0.24.14 contains a heap-based buffer over-read vulnerability in the MQTT v5 subscription information decoding function. A remote client can send a crafted SUBSCRIBE packet with malformed properties, leading to memory corruption and service disruption. This affects the broker receive path, posing a significant availability risk to IoT deployments.

Description

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from the outer Properties Length while parsing each SUBSCRIPTION_IDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing get_var_integer() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

Impact

This vulnerability impacts system availability by allowing unauthenticated or authenticated remote clients to trigger an out-of-bounds read and crash the MQTT broker process. Confidentiality and integrity impacts are minimal, but repeated crashes result in a denial of service for connected IoT devices and clients depending on the broker.

Remediation

Upgrade NanoMQ to version 0.24.14 or later where the variable integer decoding logic for subscription identifiers is corrected. If upgrading immediately is not feasible, restrict network access to the MQTT broker to trusted clients and monitor broker logs for unexpected crashes.

Risk context

Rated as a high severity issue with a CVSS v3 score of 7.5 and CVSS v4 score of 7.0, indicating a critical availability threat for systems utilizing vulnerable NanoMQ instances. While EPSS data is currently unavailable, defenders should prioritize remediation due to the ease of remote triggering via crafted MQTT packets.

Affected products

  • EMQX NanoMQ < 0.24.14

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
7
EPSS
—

NanoMQ MQTT heap-overflow denial-of-service IoT buffer-over-read

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-46655

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

View analysis

high

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenticated remote attacker can trigger this flaw by sending an oversized HTTP Basic Authorization header to an affected endpoint. This causes incorrect buffer allocation and adjacent memory overwrite, resulting in a denial of service.

View analysis