Every CVE Search/ Get API key

CVE-2026-114550

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

8.1 HighPublic exploitFix available

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.84%Unchanged since Nov 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
CVE-2026-114550
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-06
EUVDEUVD-2026-116626 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
EUVD-2026-116626
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-64rj-2w6g-r32v 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution...

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
GHSA-64rj-2w6g-r32v
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-04
NVD 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
CVE-2026-114550
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-06
OSV 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
CVE-2026-114550
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-07
OSVDEBIAN-CVE-2026-114550 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
DEBIAN-CVE-2026-114550
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
Show 4 moreShow less
OSVOESA-2026-4694 8.1

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)

Record
OESA-2026-4694
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVOESA-2026-4695 8.1

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)

Record
OESA-2026-4695
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVOESA-2026-4696 8.1

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)

Record
OESA-2026-4696
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-04
OSVUBUNTU-CVE-2026-114550 8.1

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Record
UBUNTU-CVE-2026-114550
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libwebsockets
Debian:12
 All versions, plus listed versions
4.1.6-34.1.6-3.14.3.2-14.3.2-24.3.2-3
Show 12 moreShow less
4.3.2-44.3.3-14.3.3-1.14.3.3-1.1~exp14.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7
 None known
libwebsockets
Debian:13
 All versions, plus listed versions
4.3.5-14.3.5-1+deb13u14.3.5-1+deb13u24.3.5-1+deb13u34.3.5-2
Show 6 moreShow less
4.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7
 None known
libwebsockets
Debian:14
 All versions, plus listed versions
4.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7
 None known
libwebsockets
openEuler:22.03-LTS-SP4
 before 4.3.0-13.oe2203sp4
4.3.0-13.oe2203sp4
libwebsockets
openEuler:24.03-LTS-SP1
 before 4.3.3-10.oe2403sp1
4.3.3-10.oe2403sp1
libwebsockets
openEuler:24.03-LTS-SP3
 before 4.3.3-10.oe2403sp3
4.3.3-10.oe2403sp3
libwebsockets
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2.2-11.6.0-31.6.0-41.6.0-51.6.1-1
Show 4 moreShow less
1.7.0-1ubuntu11.7.0-21.7.1-11.7.1-1ubuntu0.1~esm1
 None known
libwebsockets
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.3-32.0.3-3build12.0.3-3ubuntu0.1~esm1
 None known
libwebsockets
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.3-3build13.2.1-33.2.1-3ubuntu0.1~esm13.2.1-3ubuntu0.1~esm23.2.1-3ubuntu0.1~esm3
 None known
libwebsockets
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.0.20-24.0.20-2ubuntu14.0.20-2ubuntu1.14.0.20-2ubuntu1.1+esm14.0.20-2ubuntu1.1+esm2
 None known
libwebsockets
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
4.3.2-44.3.3-14.3.3-1.1build14.3.3-1.1build24.3.3-1.1build34.3.3-1.1ubuntu0.1~esm14.3.3-1.1ubuntu0.1~esm24.3.3-1.1ubuntu0.1~esm3
 None known
libwebsockets
Ubuntu:26.10
 All versions, plus listed versions
4.3.5-3ubuntu14.3.5-4.14.3.5-54.3.5-5ubuntu14.3.5-5ubuntu24.3.5-7ubuntu1
 None known
libwebsockets
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
4.3.5-14.3.5-34.3.5-3ubuntu14.3.5-3ubuntu1.14.3.5-3ubuntu1.2+esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubgooglesky/CVE-2026-1145502026-11-05

History

History
RecordedChangedSources
publishedCVE List, EUVD
affected, aliases, referencesOSV
exploits, factsPoC in GitHub
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
referencesOSV
aliases, productsEUVD, NVD
first indexedCVE List, GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-114550 is a high vulnerability (CVSS 8.1) in Libwebsockets, published November 3, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in libwebsockets 4.3.0-13.oe2203sp4.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open