libwebsockets CVE-2025-11678

libwebsockets must be COMPILED with the LWS_WITH_SYS_ASYNC_DNS flag enabled - this is the explicit precondition in the description and is NOT the default build, which is the primary limiting factor. The attacker must be able to sniff the victim's outbound DNS request (an on-path or adjacent-network position, consistent with AV:A) and win a race to send a spoofed DNS response whose transaction ID matches the legitimate query (reflected as AT:P). The victim application must itself trigger a DNS resolution (UI:P / passive). The malicious response must carry a DNS label exceeding the maximum length to overflow the fixed label_stack. No authentication is required (PR:N). Builds without async DNS, or deployments where DNS traffic is not observable by the attacker, are not exploitable.

This is a moderate-priority, conditionally-exploitable memory-safety flaw rather than a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:P, score 7.5 High) is internally consistent with the description: AV:A reflects that the attacker must be positioned to sniff DNS traffic (adjacent/on-path), AT:P reflects the attack requirement of observing and racing a legitimate DNS request, and UI:P reflects that the victim application must itself initiate the DNS lookup. VC:H/VI:H/VA:H correctly capture the high impact of a stack-based overflow (potential code execution or crash). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of widespread or targeted exploitation. The most important risk-limiting signal is NOT in the CVSS metrics: exploitation requires the library to have been COMPILED with the non-default LWS_WITH_SYS_ASYNC_DNS flag, which sharply narrows the real affected population. The high CVSS is therefore driven by impact severity and a plausible on-path attacker, but the compile-time gate plus the need to win a DNS transaction-ID race make real-world mass exploitation unlikely. Treat as a patch-in-normal-cycle item, prioritized higher for devices/products known to enable async DNS and reachable by on-path attackers.

An attacker on the same network segment as a libwebsockets-based device (built with LWS_WITH_SYS_ASYNC_DNS) passively observes an outbound DNS query, then forges a DNS response with the matching transaction ID that contains a DNS label longer than the maximum, overflowing the fixed-size label_stack on the stack. This can crash the process or, if the overflow is controllable, lead to code execution in the context of the application. No public exploit code is identified at time of analysis.