CVE-2026-5857
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Contiki-NG's MQTT client in parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, the parser skips the length-reading block and performs a memcpy with an unvalidated length, leading to overflow of the topic[] buffer and overwriting adjacent fields, including the payload_chunk pointer. This can enable remote code execution on devices without memory protection.
Risk Assessment
The vulnerability can lead to information disclosure, denial of service, or remote code execution on embedded devices, potentially compromising IoT system integrity.
Recommendation
Update Contiki-NG to a patched version. If possible, enable TLS for MQTT connections and restrict trust in brokers.
Other vulnerabilities in Contiki-NG
See all- CVE-2026-5856High
Contiki-NG's DNS/mDNS resolver in skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() iterates nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker can set nquestions higher than the number of complete questions, causing out-of-bounds reads past the UDP packet buffer and disclosing memory contents or crashing the resolver.
- CVE-2026-5855High
Contiki-NG's LwM2M TLV parser in lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. A crafted CoAP WRITE with a final TLV supplying exactly one byte triggers up to five out-of-bounds reads of heap memory, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
- CVE-2023-34101High
Contiki-NG is an operating system for IoT devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the system does not verify that the packet buffer is large enough, which can lead to out-of-bounds reads.
- CVE-2023-34100High
Contiki-NG, an operating system for IoT devices, has a vulnerability that allows reading data out of bounds of the IPv6 buffer when processing the MSS option in TCP packets. The issue involves buffer indexing in the module os/net/ipv6/uip6.c, which may lead to unauthorized memory access.
Original NVD description (English source)
Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.