Attack Chain

1. The client establishes a connection to a malicious, attacker-controlled MQTT broker.
2. The attacker sends a specially crafted PUBACK packet to the client.
3. The parser processes the PUBACK properties length, enters an incorrect state (LMQCPP_PUBACK_VH_PKT_ID), and fails to reset the fixed_seen counter.
4. The parser consumes subsequent bytes from the malicious packet as if they were packet headers, writing them sequentially into the _lws_mqtt_related heap allocation.
5. The OOB write overwrites internal parser bookkeeping, timer structures, and function pointers.
6. The parser sustains the write process indefinitely by steering its own internal state and bounds-check variables via the controlled data.
7. The client triggers the corrupted pointer (e.g., a timer callback or qos2_state_ops), resulting in a controlled jump to attacker-supplied memory.

Impact

The vulnerability allows an attacker to achieve control-flow hijacking, potentially leading to remote code execution (RCE). Practical exploitation requires bypassing ASLR via heap grooming and knowledge of exact build offsets, but the availability of a functional proof-of-concept (PoC) increases the risk of exploitation for unpatched systems.

Recommendation

• Update libwebsockets to version 5.0.0 or later, or ensure the library is patched with commit c9e8e1834d7f13038c82963086b90e2ee9c5b44c.
• Inventory all systems, IoT devices, or services utilizing libwebsockets with MQTT support enabled (-DLWS_ROLE_MQTT=1).
• Restrict client connectivity to known, trusted MQTT brokers to prevent exploitation by malicious brokers.