Out-of-Bounds Read Vulnerability in Libwebsockets Affects Multiple Applications

CVE-2025-11679

What is CVE-2025-11679?

The vulnerability in Libwebsockets arises due to an out-of-bounds read condition in the lws_upng_emit_next_line function. When the LWS_WITH_UPNG flag is enabled and the HTML display stack is utilized, the vulnerability may allow an attacker to read beyond a heap-allocated buffer. This could result in application crashes when users visit maliciously crafted websites containing specially designed PNG files, particularly those with exaggerated height dimensions. Implementing the latest patches is crucial to secure applications against this potential exploit.

References