CVE-2026-78161

HighCVSS 7.3

Published: 24/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.

Risk Assessment

A remote attack can cause memory corruption, potentially leading to crashes or arbitrary code execution. The organization is at risk of system integrity compromise.

Recommendation

Apply the patch identified as 1d44554a1bb262db63ff4e240152a9deecd99054 immediately to remediate the vulnerability.

Other vulnerabilities in libwebsockets

CVE-2026-10650Medium
A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.