CVE-2021-41036 Memory corruption in Eclipse Paho MQTT C Client
A buffer overflow in the Eclipse Paho MQTT C Client allows attackers to execute arbitrary code or cause denial of service via malformed packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41036?
CVE-2021-41036 is a critical memory corruption vulnerability in The Eclipse Foundation Eclipse Paho MQTT C Client, published on 2 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.
Weakness: CWE-787
Which versions are affected by CVE-2021-41036?
It affects 1 product.
Products include Eclipse Paho Mqtt C\/C\+\+ Client.
How do I fix CVE-2021-41036?
No fix has been published for CVE-2021-41036 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-41036 being exploited?
There is no known exploitation of CVE-2021-41036 in the wild and no public exploit code.
Sources
Also known as GHSA-m9hg-v7xv-429h, UBUNTU-CVE-2021-41036.