Out-of-Bounds Write in Warmcat Libwebsockets Affects Web Applications

CVE-2025-11680

What is CVE-2025-11680?

A vulnerability exists in warmcat's libwebsockets that allows for out-of-bounds writing when the LWS_WITH_UPNG flag is enabled and the HTML display stack is utilized. This flaw can be exploited by an attacker when a user visits a specially crafted webpage that includes a manipulated PNG file. The crafted file can trigger an integer overflow due to an oversized width value, resulting in potentially arbitrary write operations past allocated heap buffers. This vulnerability poses a risk of application crashes or execution of unintended code, emphasizing the need for vigilant security practices.

References