EUVD-2026-64685
GHSA-83xp-6qr9-g946
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CBOR parse path requires no auth; C/I/A limited to Low as heap corruption impact depends on layout.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
AnalysisAI
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in lecp_parse and report_raw_cbor within lib/misc/lecp.c: an equality-only bounds check (== sizeof(ctx->cbor)) fails to catch cases where cbor_pos has already exceeded the buffer limit, and cbor_pos was reset after rather than before the flush callback, creating a window for sequential over-increment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must be using libwebsockets 4.5.0 with LECP CBOR parsing enabled - specifically, the application code path must call `lecp_parse()` against attacker-supplied CBOR data, which requires that the LECP CBOR recording feature is compiled in and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.5 (Medium) reflects network reachability with no authentication or user interaction required (AV:N/AC:L/AT:N/PR:N/UI:N), but models only limited impact (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connects to a network-exposed WebSocket endpoint of a server or IoT device running libwebsockets 4.5.0 with LECP CBOR parsing active and transmits a crafted CBOR byte stream engineered so that `cbor_pos` is incremented past `sizeof(ctx->cbor)` without triggering the equality-based flush. The out-of-bounds write corrupts adjacent heap memory; at minimum this causes a process crash (denial of service), and in favorable heap layouts where attacker-controlled bytes overwrite function pointers or allocator metadata, it may yield arbitrary code execution within the process. … |
| Remediation | Apply upstream patch commit 1d44554a1bb262db63ff4e240152a9deecd99054 from the warmcat/libwebsockets repository (https://github.com/warmcat/libwebsockets/commit/1d44554a1bb262db63ff4e240152a9deecd99054). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Libwebsockets
View allSame weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today