CVE-2021-45938: 
Homebrew vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in wolfSSL wolfMQTT version 1.9. The vulnerability exists in the MqttClientDecodePacket function, which is called from MqttClientWaitType and MqttClient_Unsubscribe functions (OSS-Fuzz, OSV Report). The issue was discovered on September 22, 2021, and was subsequently fixed in a later release.

The vulnerability is classified as a heap-based buffer overflow with a WRITE operation of size 1. The issue occurs specifically in the execution path: MqttClientDecodePacket -> MqttClientWaitType -> MqttClient_Unsubscribe. According to the National Vulnerability Database, this vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to memory corruption through a heap-based buffer overflow, potentially causing application crashes or enabling arbitrary code execution. The CVSS scoring indicates that while the vulnerability doesn't impact confidentiality or integrity, it can have a high impact on system availability (NVD).

The vulnerability has been fixed in a subsequent commit (84d4b53122e0fa0280c7872350b89d5777dabbb2) to the wolfMQTT repository. Users should update to a version containing this fix to mitigate the vulnerability (GitHub Patch).