CVE-2025-11680
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In warmcat libwebsockets, there is an out-of-bounds write vulnerability in unfilter_scanline when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used. This can lead to writing past a heap allocated buffer, possibly causing a crash when the user visits an attacker-controlled website with a crafted PNG file.
Risk Assessment
An attacker can cause a crash or potentially exploit the bug for code execution. This requires the user to visit a malicious website, which could be used in phishing attacks.
Recommendation
Update libwebsockets to a patched version. If possible, disable the LWS_WITH_UPNG flag or the HTML display stack.
Other vulnerabilities in libwebsockets
See all- CVE-2026-19773Critical
libwebsockets contains an out-of-bounds write vulnerability in HTTP/2 HPACK path header parsing. The lack of proper validation of user-supplied data results in a write past the end of an allocated buffer.
- CVE-2026-78161High
A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.
- CVE-2026-10650Medium
A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to write past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big width value that causes an integer overflow which value is used for determining the size of a heap allocation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS