What is CVE-2025-59947?

CVE-2025-59947 is a critical-severity vulnerability in Emqx Nanomq, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.0/10. Published 2025-12-15.

How severe is CVE-2025-59947?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Buffer overflow in Emqx Nanomq

CVE-2025-59947

NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.

Vulnerability class: Buffer Overflow

Published 2025-12-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (23.3th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000

Affected products

Emqx Nanomq
Nanomq — versions < 0.24.4

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

References

github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3 (Vendor Advisory)
github.com/nanomq/nanomq/issues/2110 (Patch, Issue Tracking)
github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af2f43763d457b (Patch)

Frequently asked questions

What is CVE-2025-59947?: CVE-2025-59947 is a critical-severity vulnerability in Emqx Nanomq, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.0/10. Published 2025-12-15.
How severe is CVE-2025-59947?: Critical severity. CVSS v3 base score is 9.0 out of 10.