CVE-2021-45939: 
Homebrew vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in wolfMQTT version 1.9 (CVE-2021-45939). The vulnerability exists in the MqttClientDecodePacket function, which is called from MqttClientWaitType and MqttClient_Subscribe. The issue was discovered on September 23, 2021, and was fixed in a subsequent patch (OSS-Fuzz, GitHub Commit).

The vulnerability is classified as a heap-based buffer overflow WRITE vulnerability that occurs in the MqttClient_DecodePacket function. The CVSS v3.1 base score for this vulnerability is 5.5 (MEDIUM), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue affects the packet processing functionality in wolfMQTT, specifically when handling MQTT packet decoding operations (NVD).

If exploited, this vulnerability could lead to a heap buffer overflow condition, potentially resulting in program crashes or denial of service. The vulnerability primarily affects the availability of the system, with no direct impact on confidentiality or integrity (OSS-Fuzz-Vulns).

The vulnerability has been fixed in a commit to the wolfMQTT repository. Users should upgrade to a version that includes the fix (commit 84d4b53122e0fa0280c7872350b89d5777dabbb2). The fix involves modifications to the packet handling logic in the MqttClient_WaitType function (GitHub Patch).