{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/libwebsockets/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libwebsockets:libwebsockets:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-114550"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["libwebsockets (v4.2 - v4.5.8)"],"_cs_severities":["high"],"_cs_tags":["mqtt","libwebsockets","memory-corruption","rce"],"_cs_type":"advisory","_cs_vendors":["libwebsockets"],"content_html":"\u003cp\u003eCVE-2026-114550 is an unauthenticated out-of-bounds write vulnerability in the libwebsockets (lws) MQTT client role. The issue occurs when the \u003ccode\u003e_lws_mqtt_rx_parser\u003c/code\u003e function incorrectly handles the properties-length variable byte integer (VBI) within a PUBACK packet. If the parser is steered into an improper state, it fails to reset the \u003ccode\u003efixed_seen\u003c/code\u003e counter, allowing an attacker to perform a sequential OOB write of attacker-controlled bytes into the heap. This corruption can target \u003ccode\u003elws_sorted_usec_list_t\u003c/code\u003e timers and function-pointer tables, facilitating control-flow hijacking.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe client establishes a connection to a malicious, attacker-controlled MQTT broker.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a specially crafted PUBACK packet to the client.\u003c/li\u003e\n\u003cli\u003eThe parser processes the PUBACK properties length, enters an incorrect state (\u003ccode\u003eLMQCPP_PUBACK_VH_PKT_ID\u003c/code\u003e), and fails to reset the \u003ccode\u003efixed_seen\u003c/code\u003e counter.\u003c/li\u003e\n\u003cli\u003eThe parser consumes subsequent bytes from the malicious packet as if they were packet headers, writing them sequentially into the \u003ccode\u003e_lws_mqtt_related\u003c/code\u003e heap allocation.\u003c/li\u003e\n\u003cli\u003eThe OOB write overwrites internal parser bookkeeping, timer structures, and function pointers.\u003c/li\u003e\n\u003cli\u003eThe parser sustains the write process indefinitely by steering its own internal state and bounds-check variables via the controlled data.\u003c/li\u003e\n\u003cli\u003eThe client triggers the corrupted pointer (e.g., a timer callback or \u003ccode\u003eqos2_state_ops\u003c/code\u003e), resulting in a controlled jump to attacker-supplied memory.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to achieve control-flow hijacking, potentially leading to remote code execution (RCE). Practical exploitation requires bypassing ASLR via heap grooming and knowledge of exact build offsets, but the availability of a functional proof-of-concept (PoC) increases the risk of exploitation for unpatched systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate libwebsockets to version 5.0.0 or later, or ensure the library is patched with commit \u003ccode\u003ec9e8e1834d7f13038c82963086b90e2ee9c5b44c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eInventory all systems, IoT devices, or services utilizing libwebsockets with MQTT support enabled (\u003ccode\u003e-DLWS_ROLE_MQTT=1\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eRestrict client connectivity to known, trusted MQTT brokers to prevent exploitation by malicious brokers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T07:41:25Z","date_published":"2026-11-05T07:41:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-libwebsockets-mqtt-oob-write/","summary":"An unauthenticated out-of-bounds write vulnerability in the libwebsockets MQTT client allows a malicious broker to hijack control-flow via crafted PUBACK packets (CVE-2026-114550).","title":"libwebsockets: MQTT client out-of-bounds write (CVE-2026-114550)","url":"https://feed.craftedsignal.io/briefs/2026-11-libwebsockets-mqtt-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Libwebsockets","version":"https://jsonfeed.org/version/1.1"}