libwebsockets CVE-2025-11680

Requires the target application to be compiled with the non-default LWS_WITH_UPNG flag AND to use the libwebsockets HTML display stack (its experimental HTML/CSS rendering path that decodes PNGs). The victim must then visit an attacker-controlled website serving a crafted PNG whose large width value triggers an integer overflow used to size a heap allocation (UI:A victim interaction, AT:P specific crafted-input requirement, AC:H). It is unauthenticated (PR:N) and network-delivered, but the two compile-time/runtime feature gates plus required user interaction sharply limit the exposed population; most libwebsockets deployments do not enable the UPNG/HTML display stack.

This is a genuinely low-to-moderate real-world risk despite the memory-corruption class. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H, score 5.9) correctly scopes impact to availability only (VA:H) - the described outcome is a heap out-of-bounds write that 'possibly causes a crash,' with no confidentiality or integrity impact claimed. Exploitation is heavily gated: it only applies when libwebsockets is compiled with the non-default LWS_WITH_UPNG flag AND the experimental HTML display/rendering stack is actually used, and it needs victim user interaction (UI:A - visiting an attacker-controlled site). EPSS is low at 0.39% (31st percentile), there is no CISA KEV listing, and no public exploit code is referenced - only a vendor advisory and the fix commit. The AC:H / AT:P metrics reflect that a specifically crafted PNG with an oversized width must trigger an integer overflow that undersizes the heap allocation. Signals are internally consistent: moderate CVSS driven by VA:H, low EPSS, no exploitation evidence. No conflicting data - the one caveat is that OOB heap writes can sometimes be escalated beyond a crash to code execution, but neither the description nor the vendor rating claims that here, so it should be treated as a DoS until proven otherwise.

An attacker hosts a web page containing a malicious PNG whose declared width is large enough to overflow the integer used to compute a heap allocation size. A victim running an application built on libwebsockets with LWS_WITH_UPNG and the HTML display stack visits the page; the undersized buffer is written past its bounds while decoding the scanline, crashing the client. No public proof-of-concept is referenced, and the high attack complexity (AC:H) plus required user interaction make opportunistic mass exploitation unlikely.