libwebsockets CVE-2025-11679

Exploitation requires the target to have been compiled with the non-default LWS_WITH_UPNG flag AND to be actively using the HTML display stack - without both, the vulnerable lws_upng_emit_next_line path is not reachable. The trigger is a crafted PNG with an abnormally large height dimension served from an attacker-controlled website, and the victim must actively visit that site (UI:A). Limiting factors: the gating compile-time feature makes vulnerable builds uncommon, exploitation demands high attack complexity (AC:H) plus a specific attack requirement (AT:P), and the realistic outcome is a crash (availability loss) rather than code execution or data disclosure.

This is a genuinely low-to-moderate priority issue despite the OOB-read class. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A) is internally consistent with the description: network-reachable but requiring high attack complexity, a specific attack requirement (AT:P - a crafted PNG that happens to trigger the condition), and active user interaction (the victim must browse to an attacker page). Crucially the vendor scores impact as VC:N/VI:N/VA:H - confidentiality and integrity are rated nil, and only availability (a crash) is affected, which is why the base score is a modest 5.9. EPSS reinforces this: 0.39% probability at the 31st percentile indicates no meaningful expectation of mass exploitation. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' The one signal worth flagging as internally tense is the 'Information Disclosure' tag combined with CWE-125 (out-of-bounds read) versus the vendor's VC:N rating and the description, which only claims a crash - an OOB read can in principle leak heap memory, but the authoritative vendor assessment treats this as a denial-of-service (crash) issue, not a data-disclosure one. Treat this as a crash/DoS bug, not a confidentiality breach, unless the Nozomi advisory states otherwise.

An attacker hosts a web page embedding a crafted PNG whose declared height is abnormally large. A victim running a libwebsockets-based client built with LWS_WITH_UPNG and using the HTML display stack visits the page; decoding the malformed PNG drives lws_upng_emit_next_line to read past a heap-allocated buffer, likely crashing the client application. No public exploit code is identified at time of analysis, and the attack requires high complexity plus victim interaction.