libwebsockets EUVD-2026-98808

Exploitation requires that the target application use libwebsockets' LEJP incremental JSON parser (lejp_parse) on attacker-controlled input, and that the attacker can supply JSON whose nesting depth or path-element count exceeds the fixed-size ctx->i (path index) and ctx->st (stack) arrays - the vulnerable off-by-one checks (ctx->ipos > vs >= LWS_ARRAY_SIZE, and ++ctx->sp == LWS_ARRAY_SIZE) allow writing/indexing one element past the bounds before the limit is enforced. No authentication or user interaction is needed (PR:N/UI:N). The key limiting factor is deployment-dependent: libwebsockets must actually be parsing untrusted JSON via LEJP on a reachable interface; applications that only parse trusted/local configuration JSON, or that do not expose LEJP to remote input, are not remotely exploitable. Impact is limited to a process crash (availability), not disclosure or code execution.

The signals are consistent but point to a moderate, availability-only issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) shows the flaw is remotely reachable with low complexity and no privileges or user interaction, but impact is confined to availability (C:N/I:N) - a classic out-of-bounds-read denial of service (CWE-125), not code execution. SSVC reinforces this: Exploitation=poc (not active), Automatable=yes (the parser bug can be triggered reliably/at scale), and Technical Impact=partial (crash, not full system compromise). A public gist and a filed GitHub issue indicate exploit/proof-of-concept material exists, so this qualifies as 'publicly available exploit code exists' - but there is NO CISA KEV listing and NO EPSS score in the input, so claims of widespread active exploitation cannot be made. One conflict to flag explicitly: the input Tags include 'Information Disclosure' and 'Buffer Overflow', yet the CVSS vector sets C:N and the CWE is an OOB READ (125), not a write/overflow - an OOB read could in principle leak adjacent memory, but NVD rated no confidentiality impact, so treat info-disclosure as unconfirmed and the real, rated consequence as denial of service only. Net: a genuine patch-worthy bug for anyone exposing LEJP to untrusted JSON, but the ceiling is service crash, not RCE.

An attacker sends a crafted JSON payload with excessive object/array nesting (or an over-long path) to an application that feeds attacker-controlled input into libwebsockets' LEJP incremental parser. The off-by-one bounds checks on ctx->ipos and ctx->sp let the index exceed the fixed-size ctx->i/ctx->st arrays, causing an out-of-bounds read that crashes the process. Proof-of-concept material is referenced in a public gist and the upstream issue, and because the trigger is a single network-delivered message with no authentication, it is easily automatable.