libwebsockets: MQTT client out-of-bounds write (CVE-2026-114550)

CVE-2026-114550 is an unauthenticated out-of-bounds write vulnerability in the libwebsockets (lws) MQTT client role. The issue occurs when the _lws_mqtt_rx_parser function incorrectly handles the properties-length variable byte integer (VBI) within a PUBACK packet. If the parser is steered into an improper state, it fails to reset the fixed_seen counter, allowing an attacker to perform a sequential OOB write of attacker-controlled bytes into the heap. This corruption can target lws_sorted_usec_list_t timers and function-pointer tables, facilitating control-flow hijacking.

Attack Chain

1. The client establishes a connection to a malicious, attacker-controlled MQTT broker.
2. The attacker sends a specially crafted PUBACK packet to the client.
3. The parser processes the PUBACK properties length, enters an incorrect state (LMQCPP_PUBACK_VH_PKT_ID), and fails to reset the fixed_seen counter.
4. The parser consumes subsequent bytes from the malicious packet as if they were packet headers, writing them sequentially into the _lws_mqtt_related heap allocation.
5. The OOB write overwrites internal parser bookkeeping, timer structures, and function pointers.
6. The parser sustains the write process indefinitely by steering its own internal state and bounds-check variables via the controlled data.
7. The client triggers the corrupted pointer (e.g., a timer callback or qos2_state_ops), resulting in a controlled jump to attacker-supplied memory.

Impact

The vulnerability allows an attacker to achieve control-flow hijacking, potentially leading to remote code execution (RCE). Practical exploitation requires bypassing ASLR via heap grooming and knowledge of exact build offsets, but the availability of a functional proof-of-concept (PoC) increases the risk of exploitation for unpatched systems.

Recommendation

• Update libwebsockets to version 5.0.0 or later, or ensure the library is patched with commit c9e8e1834d7f13038c82963086b90e2ee9c5b44c.
• Inventory all systems, IoT devices, or services utilizing libwebsockets with MQTT support enabled (-DLWS_ROLE_MQTT=1).
• Restrict client connectivity to known, trusted MQTT brokers to prevent exploitation by malicious brokers.