Integer Overflow Vulnerability in Real-time Communication Library by Baresip
CVE-2026-50161
What is CVE-2026-50161?
The libre library, utilized for real-time communications, contains an integer overflow in the websock_decode() function prior to version 4.8.1. This vulnerability arises when validating masked WebSocket frames with 64-bit extended length encoding. Specifically, when the header length approaches the maximum value for a 64-bit integer, the calculation may wrap unexpectedly, leading to inadequate bounds checking. This flaw can result in a situation where the subsequent processing step writes beyond allocated heap memory, potentially causing heap corruption or denial of service after the HTTP WebSocket upgrade handshake. Applications implementing WebSocket servers using websock_accept() or websock_accept_proto() are particularly at risk. Baresip has released version 4.8.1 to address this issue.
Affected Version(s)
re < 4.8.1