CVE-2024-10525

A heap-based out-of-bounds memory-access flaw (CWE-122/CWE-787) exists in Eclipse Mosquitto's client library libmosquitto in versions 1.3.2 through 2.0.18. When an MQTT client built on libmosquitto — including the bundled mosquitto_sub and mosquitto_rr command-line tools — connects to a malicious or compromised broker that responds with a crafted SUBACK packet containing no reason codes, the on_subscribe callback can access memory out of bounds. An attacker who controls the broker a client connects to could corrupt client memory or crash it, with the CVSS 4.0 score of 7.2 (High) indicating potentially high integrity and availability impact but only low confidentiality impact. Only client-side deployments are affected — scripts and applications using libmosquitto, mosquitto_sub, or mosquitto_rr — while the Mosquitto broker process itself is not vulnerable. There is no confirmed in-the-wild exploitation (not in CISA KEV), but one public proof of concept exists, and EPSS ranks the flaw in the 99th percentile with roughly a 59% probability of exploitation within 30 days.

What to do: Upgrade all Mosquitto client components (libmosquitto, mosquitto_sub, mosquitto_rr) to a release newer than 2.0.18 (2.0.19 or later), and rebuild or update any application or device firmware that statically links libmosquitto, checking distro repositories for patched backports. Until patched, restrict clients to trusted brokers and enforce TLS with certificate validation so an attacker cannot impersonate the broker. Note that Mosquitto broker hosts are not themselves vulnerable, so prioritize inventorying MQTT client software rather than broker deployments.