Vendor
An unauthenticated out-of-bounds write vulnerability in the libwebsockets MQTT client allows a malicious broker to hijack control-flow via crafted PUBACK packets (CVE-2026-114550).