{"id":"CVE-2026-5857","summary":"Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments","details":"Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.","modified":"2026-08-09T03:30:31.715679400Z","published":"2026-08-06T18:52:40.005Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5857.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d"}]},{"extracted_events":[{"introduced":"1"}],"source":"DESCRIPTION"}],"cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5857.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5857"},{"type":"REPORT","url":"https://github.com/contiki-ng/contiki-ng/pull/3163"},{"type":"FIX","url":"https://github.com/contiki-ng/contiki-ng/commit/a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d"},{"type":"PACKAGE","url":"https://github.com/contiki-ng/contiki-ng"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contiki-ng/contiki-ng","events":[{"introduced":"0"},{"fixed":"a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d"}],"database_specific":{"source":"REFERENCES"}}],"versions":["develop/v5.1","develop/v5.0","develop/v4.9","develop/v4.8","develop/v4.7","develop/v4.6","develop/v4.5","develop/v4.4","develop/v4.3","develop/v4.2","develop/v4.1","develop/v4.0","fork","develop/v3.x-fork","old/v2.6","2.6-rc0","2.6","2.5-release","old/v2.4","2.4","old/v2.3","2.3","old/v2.2.3","2.2.3","old/v2.2.2","2.2.2","old/v2.2.1","2.2.1","old/v2.2","2.2","old/v2.1","2.1","old/v2.0","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5857.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}