# CVE-2026-78161: warmcat libwebsockets out-of-bounds write in LECP CBOR parsing

Source: https://junglewise.ai/threats/cve-2026-78161-warmcat-libwebsockets-out-of-bounds-write-in-lecp-cbor-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78161 · Severity: high · CVSS 7.3 · Published 2026-08-24

libwebsockets is a widely-used C library for WebSocket communication. The LECP CBOR recording feature contains a write-before-check bug that allows writing one byte past an internal buffer boundary when handling untrusted CBOR data, potentially corrupting adjacent memory and causing application crashes or type confusion that could be exploited by an attacker sending malicious CBOR messages.

Technologies: [Warmcat Libwebsockets](https://junglewise.ai/threats/technologies/libwebsockets). Vendors: [Warmcat](https://junglewise.ai/threats/vendors/warmcat).

## Quick answers

**Is CVE-2026-78161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78161 being exploited in the wild.

**How severe is CVE-2026-78161?** High severity, with a CVSS score of 7.3, published 24 August 2026.

**Which products and versions are affected?** Warmcat Libwebsockets 4.5.0.

**Is there a fix for CVE-2026-78161?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78161 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78161?** Check whether you run Warmcat Libwebsockets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a write-before-check out-of-bounds write in lib/misc/lecp.c (lines 390-394). When literal_cbor_report is enabled, the code writes to ctx->cbor[ctx->cbor_pos++] before checking if cbor_pos has reached the buffer size (64 bytes). When the buffer fills and report_raw_cbor() is called, if the application callback rejects the LECPCB_LITERAL_CBOR event, cbor_pos is not reset and remains at 64. On the next call to lecp_parse(), the first byte writes to ctx->cbor[64], overflowing into the adjacent ctx->item struct. An attacker can control the byte value written (0x00-0xFF) by controlling CBOR input. The attack is remotely triggerable if the application parses untrusted CBOR with literal reporting enabled (e.g., COSE signature processing), and requires specific conditions: callback rejection followed by parser retry. The patch is commit 1d44554a1bb262db63ff4e240152a9deecd99054.

## Affected products

- warmcat libwebsockets 4.5.0

## Timeline

- 2026-08-24: disclosed: CVE-2026-78161 published on NVD
- 2026-08-24: other: Exploit proof-of-concept made public

## References

- [https://github.com/biniamf/pocs/blob/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write/poc_lecp_cbor_pos_oob.c](https://github.com/biniamf/pocs/blob/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write/poc_lecp_cbor_pos_oob.c)
- [https://github.com/biniamf/pocs/tree/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write](https://github.com/biniamf/pocs/tree/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write)

## Related threats

- [libwebsockets out-of-bounds read in LEJP parser](https://junglewise.ai/threats/cve-2026-95114-libwebsockets-contains-an-out-of-bounds-read-vulnerability-in-the)
- [Warmcat libwebsockets resource consumption in SSH Protocol Handler](https://junglewise.ai/threats/cve-2026-10650-warmcat-libwebsockets-resource-consumption-in-ssh-protocol)