A use after free vulnerability in Redboltz async_mqtt 10.2.5 poses a denial of service risk to systems utilizing the library for MQTT communications.

The vulnerability is a use after free flaw occurring in endpoint destructors. It is triggered by an SSL initialization failure, which causes an incorrect destruction order between io_context and endpoint objects, and it is accessible to unauthenticated local users.

Successful exploitation of this vulnerability allows an attacker to cause a denial of service on the affected application. With a CVSS score of 7.5, this high severity flaw could lead to significant operational disruption if the MQTT service is critical to business processes or industrial control communications.

Immediate Action: Upgrade to a patched version of async_mqtt as provided by the vendor in the referenced pull request (https://github.com/redboltz/async_mqtt/pull/437).

Proactive Monitoring: Monitor system logs for unexpected service crashes or errors related to SSL initialization and MQTT endpoint management.

Compensating Controls: Ensure that systems running the library are protected by restricting local user access and implementing resource limits to contain the impact of potential service crashes.

Public Exploit Available: Unknown

The high CVSS score reflects the ease of triggering this denial of service condition. Organizations should prioritize updating the async_mqtt library to the version containing the fix to ensure stability and prevent unauthorized service termination.