libre CVE-2026-50161

Exploitation requires that the target application uses libre's WebSocket server functionality via websock_accept() or websock_accept_proto() and that the attacker can reach that endpoint and complete the HTTP WebSocket upgrade handshake. The specific trigger is a masked WebSocket frame using the 64-bit extended payload length encoding with hdr->len set close to UINT64_MAX so that 4 + hdr->len wraps. No authentication is required (PR:N) and no user interaction is needed (UI:N); the frame must be a masked frame (as sent by clients to a server). Limiting factors: only applications acting as WebSocket servers with libre versions before 4.8.1 are affected, and the endpoint must be network-reachable by the attacker - deployments that do not expose a libre WebSocket server, or that gate the endpoint behind authentication/proxy validation, are not directly exploitable.

All primary signals point the same direction and are consistent: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, base 9.3 Critical) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity and availability, matching a description of attacker-controlled heap corruption or DoS reachable by any client that completes a WebSocket upgrade. There is no CISA KEV listing and no evidence of a public proof-of-concept in the provided data, so active exploitation is not indicated; EPSS and SSVC data were not provided. The realistic near-term risk is denial of service (heap corruption reliably crashes the process), while reliable remote code execution from a heap overwrite is plausible but harder and heap-layout dependent - the high I/C ratings reflect worst-case potential rather than a demonstrated code-execution exploit. This is a genuine patch priority for anyone exposing a libre-based WebSocket server, but the absence of KEV/POC suggests it is not yet under mass exploitation. No conflicting signals were observed; missing data are EPSS, SSVC and POC status.

An attacker connects to an internet-exposed service built on libre, completes the standard HTTP-to-WebSocket upgrade handshake, then sends a single masked WebSocket frame declaring a 64-bit extended length near UINT64_MAX. The integer overflow bypasses the bounds check and the unmasking loop writes past the heap buffer, crashing the service or corrupting adjacent heap allocations; no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N). No public exploit code was identified in the provided data.