The vulnerability arises from improper validation of the HTTP/2 HPACK path header during parsing. A crafted header can cause an out‑of‑bounds write, allowing an attacker to overwrite adjacent memory and execute arbitrary code in the context of the running process. This flaw enables remote code execution without authentication, giving full control over the affected application.

Products affected are implementations of libwebsockets where the HTTP/2 HPACK path header parsing is active. The vulnerability is present in all versions of libwebsockets up to the release that fixed the issue. The vendor is libwebsockets:libwebsockets. Specific versions are not enumerated in the current data.

The CVSS score of 9.8 reflects a high severity remote code execution risk. EPSS is not available, and the vulnerability is not yet listed in CISA KEV, but the lack of authentication and the nature of the buffer overflow make exploitation trivial for an attacker who can send crafted HTTP/2 traffic to a vulnerable server. The likely attack vector is remote network traffic directed at a service using libwebsockets; the attacker does not need to authenticate.