CVE-2025-59947: 
NixOS vulnerability analysis and mitigation

CVE-2025-59947 is a heap buffer overflow vulnerability in NanoMQ, a lightweight MQTT messaging broker/bus designed for IoT Edge and Software-Defined Vehicle (SDV) environments. The flaw affects all NanoMQ versions prior to 0.24.4 and is triggered when MQTT PUBLISH packets simultaneously activate both shared subscriptions and vanilla (regular) subscriptions. It was reported on September 2, 2025, and publicly disclosed on December 15, 2025, with a fix released in version 0.24.4. The vulnerability carries a CVSS v3.1 score of 9.0 (Critical) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a classic buffer copy without size checking (CWE-120), located in the foreach_client function within nanomq/pub_handler.c. Specifically, the cvector_grow call incorrectly grew the msg_infos vector to ctx_list_len instead of ctx_list_len + cvector_size(msg_infos), causing a heap buffer overflow when both shared and vanilla subscriptions were active for the same topic. AddressSanitizer output from the bug report confirms a WRITE of 4 bytes past the end of a 24-byte heap region during a memcpy in foreach_client at pub_handler.c:127. The fix, committed as 5f5581054bb92f102cf99251e8af2f43763d457b, corrects the growth calculation to account for the existing vector size (GitHub Issue, GitHub Commit).

Successful exploitation can result in high-impact integrity and availability compromise of the NanoMQ broker, including potential denial of service via crash or memory corruption, and possible arbitrary code execution. The vulnerability also carries a high confidentiality impact on subsequent systems, as a compromised broker could expose all MQTT messages transiting through it — a significant risk in IoT and SDV environments where sensitive telemetry or control data may be in transit. The changed scope in the CVSS v3.1 rating indicates that exploitation can affect systems beyond the vulnerable broker itself (GitHub Advisory).

No public proof-of-concept exploit code has been released; the reporter (roman-kraus-fokus) indicated a PoC exists but chose to share it privately with the vendor to avoid endangering NanoMQ deployments. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, reflecting low near-term exploitation probability. Exploitation requires low privileges (an authenticated MQTT client) and passive user interaction, limiting but not eliminating risk for exposed deployments (GitHub Issue, Red Hat CVE).

1. Reconnaissance: Identify NanoMQ broker instances (versions < 0.24.4) exposed on the network, typically listening on MQTT port 1883 or 8883 (TLS). Tools like Shodan or nmap can be used to locate open MQTT services.
2. Obtain low-privilege access: Register or authenticate as a low-privileged MQTT client on the target broker (e.g., using mosquitto_pub/mosquitto_sub or a custom MQTT client library).
3. Set up subscriptions: Subscribe to a topic using both a shared subscription (e.g., $share/group/test/topic) and a regular vanilla subscription (e.g., test/topic) from one or more clients, ensuring both subscription types are active simultaneously.
4. Trigger the overflow: Publish an MQTT PUBLISH packet to the topic (e.g., test/topic) that matches both the shared and vanilla subscriptions. The foreach_client function in pub_handler.c will attempt to grow the msg_infos vector with an incorrect size, causing a heap buffer overflow.
5. Achieve impact: Depending on heap layout and platform, the overflow may crash the broker (denial of service) or, in a more sophisticated scenario, enable memory corruption leading to arbitrary code execution on the broker host (GitHub Issue, GitHub Commit).

• Logs: NanoMQ crash logs or core dumps referencing pub_handler.c or foreach_client; AddressSanitizer output showing heap-buffer-overflow at pub_handler.c:127 if compiled with ASan.
• Process: Unexpected termination or restart of the nanomq process; abnormal memory usage spikes in the broker process preceding a crash.
• Network: Unusual MQTT PUBLISH traffic to topics that have both shared ($share/group/...) and regular subscriptions active simultaneously, especially from low-privilege clients; repeated connection/disconnection cycles from the same client following broker crashes.
• File System: Presence of core dump files in the NanoMQ working directory following unexpected process termination (GitHub Issue).

Upgrade NanoMQ to version 0.24.4 or later, which contains the fix for this vulnerability. As an interim workaround for deployments that cannot immediately upgrade, disable shared subscription functionality in the NanoMQ configuration to prevent the vulnerable code path from being triggered. Additionally, restrict network access to NanoMQ instances to only trusted clients and minimize the number of low-privilege accounts that can publish to topics with mixed subscription types (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by researcher roman-kraus-fokus from FOKUS Fraunhofer Institute and disclosed via GitHub's security advisory process. The reporter noted a PoC was available but withheld from public release to protect NanoMQ users. The advisory was published by NanoMQ maintainer JaylinYu on December 14–15, 2025. Coverage has been limited to automated vulnerability tracking platforms (Vulners, VulDB, INCIBE-CERT) and a brief mention on Bluesky's CVE tracking account, with no significant broader media or researcher commentary observed (GitHub Advisory, GitHub Issue).