Heap-Based Buffer Overflow Vulnerability in wolfMQTT by wolfSSL

CVE-2021-45939

What is CVE-2021-45939?

The vulnerability in wolfMQTT version 1.9 manifests as a heap-based buffer overflow, which occurs in the MqttClient_DecodePacket function. This flaw is triggered during the processing of MQTT packets in the MqttClient_WaitType and MqttClient_Subscribe operations. Exploiting this vulnerability could potentially allow an attacker to manipulate memory and execute arbitrary code, compromising the integrity of affected applications. For further insights, refer to the project’s GitHub commit and discussions on OSS Fuzz, which underscore the critical need for updates to mitigate such risks.

References