Executive brief
libwebsockets is a widely-used C library for WebSocket communication. The LECP CBOR recording feature contains a write-before-check bug that allows writing one byte past an internal buffer boundary when handling untrusted CBOR data, potentially corrupting adjacent memory and causing application crashes or type confusion that could be exploited by an attacker sending malicious CBOR messages.
Technical details
The vulnerability is a write-before-check out-of-bounds write in lib/misc/lecp.c (lines 390-394). When literal_cbor_report is enabled, the code writes to ctx->cbor[ctx->cbor_pos++] before checking if cbor_pos has reached the buffer size (64 bytes). When the buffer fills and report_raw_cbor() is called, if the application callback rejects the LECPCB_LITERAL_CBOR event, cbor_pos is not reset and remains at 64. On the next call to lecp_parse(), the first byte writes to ctx->cbor[64], overflowing into the adjacent ctx->item struct. An attacker can control the byte value written (0x00-0xFF) by controlling CBOR input. The attack is remotely triggerable if the application parses untrusted CBOR with literal reporting enabled (e.g., COSE signature processing), and requires specific conditions: callback rejection followed by parser retry. The patch is commit 1d44554a1bb262db63ff4e240152a9deecd99054.
Affected products
- warmcat libwebsockets 4.5.0
Timeline
- 2026-08-24: disclosed: CVE-2026-78161 published on NVD
- 2026-08-24: other: Exploit proof-of-concept made public