A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
CVSS Details
- CVSS 4.0 Base Score: 5.5 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libwebsockets | Sep 21, 2026 | Aug 24, 2026 |
| Ubuntu | — | Upgrade libwebsockets-test-server-commonUpgrade libwebsockets-evlib-uv (Ubuntu Pro)Upgrade libwebsockets15 (Ubuntu Pro)Upgrade libwebsockets19t64 (Ubuntu Pro)Upgrade libwebsockets16 (Ubuntu Pro)Upgrade libwebsockets-evlib-glib (Ubuntu Pro)Upgrade libwebsockets-test-server (Ubuntu Pro)Upgrade libwebsockets-test-server-common (Ubuntu Pro)Upgrade libwebsockets19t64Upgrade libwebsockets-evlib-uvUpgrade libwebsockets-evlib-evUpgrade libwebsockets-dev (Ubuntu Pro)Upgrade libwebsockets-devUpgrade libwebsockets-evlib-glibUpgrade libwebsockets-test-serverUpgrade libwebsockets-evlib-ev (Ubuntu Pro) | Sep 28, 2026 | Sep 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub