CVE-2024-10525 — Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bo…
Published: 2024-10-30 · CVSS: 7.2 · CVSS 4.0
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7