CVE-2026-5857

Name of the Vulnerable Software and Affected Versions Contiki-NG (affected versions not specified)

Description The MQTT client contains a flaw in the parse publish vhdr() function within os/net/app-layer/mqtt/mqtt.c. The function sets the topic len received flag to 1 before validating the topic len against the 64-byte limit. If a topic exceeds this limit, the function returns early but maintains the flag as set. When the next TCP segment arrives, tcp input() re-invokes the parser; because topic len received is already 1, the parser skips the length-validation block and proceeds directly to a memcpy() operation. This operation uses an unvalidated 16-bit topic len as the copy length, causing the 65-byte topic[] buffer to overrun into adjacent structure fields, including the payload chunk pointer. A compromised or attacker-controlled broker can exploit this to achieve an arbitrary-pointer-write primitive. Since the MQTT implementation lacks TLS support, connections are plaintext. This can lead to information disclosure, denial of service, or remote code execution on embedded targets lacking memory protection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.