Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-10525

High

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback.

Published Oct 30, 2024 · Updated Sep 29, 2026 · Also known as DEBIAN-CVE-2024-10525, DLA-4059-1, ROOT-OS-ALPINE-318-CVE-2024-10525, ROOT-OS-ALPINE-320-CVE-2024-10525, UBUNTU-CVE-2024-10525

Key Facts

Patch immediately
  • CVE-2024-10525 is a high-severity vulnerability (CVSS 7.2 v4) affecting Mosquitto (Eclipse), rootio-mosquitto, libmosquitto1 (suse) and 3 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 59% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Mosquitto 2.0.19, Mosquitto 0.15-2+deb7u3ubuntu0.1+esm1, Mosquitto 1.4.15-2ubuntu0.18.04.3+esm2.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v4

7.2

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

59%

Higher than 99.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2024-10525 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

Affected Products

44 affected entries in total
ProductAffected versionsFixed in
MosquittoEclipse>= 1.3.22.0.19
rootio-mosquittorootioSee advisory2.0.18-r00071
libmosquitto1suseSee advisory2.0.23-bp160.1.1
libmosquittopp1suseSee advisory2.0.23-bp160.1.1
mosquitto-clientssuseSee advisory2.0.23-bp160.1.1
1 more affected products in the full CVE brief

Patched Releases

Mosquitto

2.0.19, 0.15-2+deb7u3ubuntu0.1+esm1, 1.4.15-2ubuntu0.18.04.3+esm2, 1.4.8-1ubuntu0.16.04.7+esm2, 1.6.9-1ubuntu0.1~esm2, 2.0.11-1.2+deb12u2, 2.0.11-1+deb11u2, 2.0.11-1ubuntu1.2, 2.0.18-1ubuntu0.1~esm1, 2.0.18-r00071, 2.0.18-r00072, 2.0.18-r00073, 2.0.18-r00074, 2.0.18-r00075, 2.0.20-1, 2.0.23-bp160.1.1

libmosquitto1

2.0.23-bp160.1.1

libmosquittopp1

2.0.23-bp160.1.1

mosquitto-clients

2.0.23-bp160.1.1

mosquitto-devel

2.0.23-bp160.1.1

rootio-mosquitto

2.0.18-r00071, 2.0.18-r00072, 2.0.18-r00073, 2.0.18-r00074, 2.0.18-r00075

Timeline

  1. Publicly disclosed

    Oct 30, 2024

  2. Last updated

    Sep 29, 2026

Weakness Type

  • CWE-122 Heap-based Buffer Overflow
  • CWE-787 Out-of-bounds Write

References

6 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-10525 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo