Out-Of-Bounds Write Vulnerability in libwebsockets MQTT Protocol
CVE-2026-114550

8.1HIGH

Key Information:

Vendor

Libwebsockets

Status
Libwebsockets
Vendor
CVE Published:
3 November 2026

What is CVE-2026-114550?

The vulnerability in libwebsockets arises from improper handling of PUBACK packets within the MQTT Protocol, allowing remote attackers to exploit the flaw. This security issue stems from insufficient validation of input data, leading to the potential for arbitrary code execution by writing beyond the allocated memory buffer. Attackers do not require authentication to take advantage of this vulnerability, increasing the risk for affected installations.

Affected Version(s)

libwebsockets b4b5aed3903eaff09cd76a410f69bbe5dff66f8e

References

https://www.zerodayinitiative.com/advisories/ZDI-26-792/
x_research-advisory
https://github.com/warmcat/libwebsockets/commit/c9e8e1834...
vendor-advisory

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.