CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-8686 - Heap out-of-bounds read in coreMQTT MQTT5 property parsing

unknownCVE-2026-8686
Bulletin ID: 2026-032-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 05/15/2026 11:45 AM PDT Description: coreMQTT is a lightweight MQTT client library for embedded devices. We identified CVE-2026-8686, an issue where missing bounds validation in the MQTT v5.0 SUBACK and UNSUBACK property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service (crash via heap out-of-bounds read) by sending a crafted packet. Impacted versions: v5.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: AWSproduct: coreMQTTDenial of serviceaffected: v5.0.0
What
Missing bounds validation allows denial of service via crafted MQTT packets.
Who is affected
Users of coreMQTT version 5.0.0.
Urgency
Remediation is urgent due to the potential for service crashes.
Action
Upgrade to version 5.0.1 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch coreMQTT

Get an email when a new coreMQTT advisory drops — max one per day, one-click unsubscribe.

Details

Source
AWS Security Bulletins (INTL · vendor-psirt · site)
Severity
unknown
Published
2026-08-20
Exploitation
Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-032-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-8686coverage & exploitation statusNVD · CVE.org

More from AWS Security Bulletins