CVE-2026-5857 in Contiki-NG
Summary
by MITRE • 08/07/2026
Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described represents a critical buffer overflow flaw in Contiki-NG's MQTT client implementation that stems from improper state management and input validation during message parsing. This issue exists within the parse_publish_vhdr() function located in os/net/app-layer/mqtt/mqtt.c, where the software incorrectly sets topic_len_received=1 before performing necessary length validations against the 64-byte limit imposed on MQTT topics. The flaw creates a dangerous race condition that allows an attacker to manipulate the parsing state through carefully crafted network traffic, ultimately leading to memory corruption and potential remote code execution in vulnerable embedded systems.
The technical execution of this vulnerability follows a specific sequence that exploits the state persistence mechanism within the MQTT parser. When an initial TCP segment containing an oversized topic (65 bytes) is received, the parser prematurely sets topic_len_received=1 before validating the topic length against the 64-byte restriction. This early flag setting causes subsequent TCP segments to trigger a re-parsing operation where tcp_input() calls the parser with topic_received==0 but the persisted topic_len_received==1 condition. The parser then skips the critical length-reading block that contains the protective guard mechanisms, directly proceeding to execute a memcpy() operation using an unvalidated 16-bit topic_len value as the copy length parameter. This fundamental flaw in input validation creates a direct path for attackers to overwrite adjacent memory structures.
The memory corruption occurs when the 65-byte topic buffer overflows into adjacent struct fields, specifically compromising the payload_chunk pointer field that subsequent MQTT processing code relies upon for dereferencing operations. This overflow creates an arbitrary-pointer-write primitive that fundamentally undermines the security model of the embedded system, as attackers can manipulate where data is written within the application's memory space. The vulnerability operates entirely within the plaintext MQTT protocol implementation without any transport layer encryption, making it particularly dangerous in environments where network traffic interception is possible. The lack of TLS support in Contiki-NG's MQTT client means that attackers do not need to perform complex cryptographic attacks to exploit this vulnerability.
The operational impact of this vulnerability spans multiple security domains including information disclosure, denial of service, and remote code execution capabilities on embedded targets lacking memory protection mechanisms. From a cybersecurity perspective, this vulnerability aligns with CWE-121 heap-based buffer overflow and CWE-787 out-of-bounds write conditions, while the attack pattern follows typical exploit techniques described in MITRE ATT&CK framework under T1059 command and scripting interpreter and T1203 proxy execution. The vulnerability affects embedded IoT devices running Contiki-NG operating system where MQTT communication is utilized for device-to-cloud connectivity, potentially compromising entire networks of connected devices that rely on this vulnerable software stack. Organizations deploying such systems face significant risk from adversaries who can leverage this flaw to gain persistent access to network infrastructure, manipulate device behavior, or cause widespread service disruption through denial-of-service attacks.
Mitigation strategies should focus on immediate code patches to correct the state management logic in parse_publish_vhdr() function, ensuring that topic_len_received flag is only set after successful validation of topic length against established limits. Additionally, implementing proper input sanitization and bounds checking before any memory operations would prevent the overflow condition from occurring. Network-level protections such as firewall rules to limit MQTT traffic to trusted sources and monitoring for anomalous topic lengths could provide additional defense-in-depth layers. However, the most effective remediation requires complete removal of the vulnerable code pattern and implementation of robust validation mechanisms that prevent state corruption during network protocol parsing operations.