wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttDecodeDisconnect (called from MqttClientDecodePacket and MqttClient_WaitType).