CivetWeb contains a heap and stack buffer overflow in its read_websocket() routine that is triggered when compressed WebSocket frames are processed during a permessage-deflate handshake. An unauthenticated attacker can craft a frame with the RSV1 bit set, causing the server to write a zlib sync trailer past the bounds of an allocated buffer. This corrupts heap metadata, leading to a denial of service or, in the worst case, execution of arbitrary code. The weakness is classified as CWE‑787, a classic buffer overflow vulnerability.

The affected product is CivetWeb. No specific release numbers are listed, but the issue exists in versions compiled with the USE_ZLIB and MG_EXPERIMENTAL_INTERFACES options before the commit that introduced the fix. Version information is not provided in the CVE data, so any deployment of CivetWeb that retains these compile options remains at risk.

The CVSS score of 8.3 indicates a high severity vulnerability, however the EPSS score of less than 1% shows that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by connecting to the WebSocket service and negotiating permessage-deflate during the handshake without authentication. Upon sending a maliciously crafted frame, memory corruption occurs, potentially allowing the attacker to achieve code execution or cause a service outage.