CVE-2018-18764

CVE-2018-18764 is a critical arbitrary memory read vulnerability affecting Cesanta Mongoose 6.13, specifically within its MQTT packet-parsing functionality. This heap-based buffer over-read, triggered by a specially crafted MQTT SUBSCRIBE packet, can lead to information disclosure and denial of service. With a CVSS score of 9.1 (CRITICAL), it presents a severe risk as it can be exploited remotely over the network without user interaction. While there is no known active exploitation, publicly available exploit code, or KEV listing, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.