CVE-2026-54412
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker or able to inject MQTT traffic into an unencrypted session can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.
Risk Assessment
An attacker can cause a crash of the MQTT-C client, leading to service disruption, and potentially disclose sensitive data from memory.
Recommendation
Update the MQTT-C library to a patched version or use encryption (TLS) for MQTT connections to prevent packet injection.
Related vulnerabilities
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
- CVE-2026-86152Critical
A flaw has been found in Tenda CP3 (version 27.5.57.101) in the CAutoAddWifi::ThreadProc function of the Functions/AutoAddWifi.cpp file in the Kylin component. Executing a manipulation can lead to OS command injection. The attack may be launched remotely.
- CVE-2026-86151Critical
A vulnerability was detected in Tenda CP3 (version 27.5.57.101) in the sub_2F77E8 function of the Apis/system.c file in the Network Configuration Management component. Performing a manipulation results in OS command injection. The attack may be initiated remotely.
- CVE-2026-86149Critical
A vulnerability has been identified in Tenda CP3 27.5.57.101 in the file Net/NetCheckPing.cpp. Manipulation of the interface_name/host arguments causes OS command injection. The attack can be initiated remotely.
- CVE-2026-86148Critical
A vulnerability has been discovered in Tenda CP3 27.5.57.101 in the SystemAsh function of the file Apis/system.c of the Kylin component. Manipulation of the AlarmVoiceURL argument results in OS command injection. The attack can be launched remotely.
Original NVD description (English source)
LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated attacker controlling an MQTT broker - or able to inject MQTT traffic into an unencrypted session - to crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.