CVE-2018-18765

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

• CWE-125

• https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.mdExploit, Third Party Advisory
• https://twitter.com/thracky/status/1059472674940993541Third Party Advisory
• https://github.com/TiffanyBlue/PoCbyMyself/blob/master/mongoose6.13/mqtt/Cesanta%20Mongoose%20MQTT%20mg_mqtt_next_subscribe_topic%20heap%20buffer%20overflow.mdExploit, Third Party Advisory
• https://twitter.com/thracky/status/1059472674940993541Third Party Advisory

Published

Oct 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1876IBM Robotic Process Automation with Automation Anywhere 11 c…6.2
• CVE-2018-18760RhinOS 3.0 build 1190 allows CSRF.
• CVE-2018-18761SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL]…9.8
• CVE-2018-18762SaltOS 3.1 r8126 contains a database download vulnerability.
• CVE-2018-18763SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuar…
• CVE-2018-18764An exploitable arbitrary memory read vulnerability exists in…
• CVE-2018-18766An elevation of privilege vulnerability exists in the Call D…
• CVE-2018-18767An issue was discovered in D-Link 'myDlink Baby App' version…
• CVE-2018-1877IBM Robotic Process Automation with Automation Anywhere 11 c…6.2
• CVE-2018-18771An issue was discovered in LuLu CMS through 2015-05-14. back…
• CVE-2018-18772CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8…
• CVE-2018-18773CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8…