libwebsockets CVE-2026-78161

The target application must be using libwebsockets 4.5.0 with LECP CBOR parsing enabled - specifically, the application code path must call lecp_parse() against attacker-supplied CBOR data, which requires that the LECP CBOR recording feature is compiled in and active. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication is required and no special attack preconditions exist beyond network reachability to a WebSocket endpoint that feeds data into lecp_parse. Applications that use libwebsockets exclusively for HTTP, standard WebSocket frames without CBOR payloads, or that validate CBOR input length before calling lecp_parse are not exposed through this code path. The primary limiting factor is functional - only deployments with LECP CBOR recording active are vulnerable.

The CVSS 4.0 score of 5.5 (Medium) reflects network reachability with no authentication or user interaction required (AV:N/AC:L/AT:N/PR:N/UI:N), but models only limited impact (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N). These impact metrics may be conservative: uncontrolled out-of-bounds writes in C heap memory can produce outcomes ranging from reliable denial-of-service to remote code execution depending on allocator layout, adjacent structure content, and whether the attacker can influence heap state. The public POC (github.com/biniamf/pocs) elevates practical risk beyond the numeric score. The vulnerability is not present in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis; exploitation appears limited and opportunistic rather than mass-scale. No EPSS score was included in the input data, so statistical exploitation probability cannot be quantified. The greatest real-world exposure lies in IoT and embedded deployments of libwebsockets where firmware update cycles are slow and LECP CBOR parsing is an active feature.

An attacker connects to a network-exposed WebSocket endpoint of a server or IoT device running libwebsockets 4.5.0 with LECP CBOR parsing active and transmits a crafted CBOR byte stream engineered so that cbor_pos is incremented past sizeof(ctx->cbor) without triggering the equality-based flush. The out-of-bounds write corrupts adjacent heap memory; at minimum this causes a process crash (denial of service), and in favorable heap layouts where attacker-controlled bytes overwrite function pointers or allocator metadata, it may yield arbitrary code execution within the process. A public POC demonstrating the OOB write is available at https://github.com/biniamf/pocs/tree/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write.