The vulnerable function websock_decode() validates the length of a masked WebSocket frame without protecting against an integer overflow when the 64‑bit extended length is close to the maximum unsigned 64‑bit value. The overflow makes the bounds check on the read buffer pass, and the subsequent XOR unmasking loop writes beyond the end of the heap buffer, causing heap memory corruption or a denial of service. The weakness is a classic integer overflow (CWE-190) followed by a resulting heap buffer overflow (CWE-787). An attacker manipulating a WebSocket frame during the HTTP upgrade handshake can trigger the overflow, causing heap memory corruption or service disruption.

The vulnerability is present in the baresip re project in all releases prior to version 4.8.1. WebSocket servers built with websock_accept() or websock_accept_proto() in libres’ websock.c are impacted. The issue was fixed by the release tagged v4.8.1 and subsequent commits that corrected the length calculation.

The CVSS score of 9.3 indicates a severe risk, but the EPSS score is presently unavailable, making it difficult to gauge how often the exploit is being used in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a network attacker sending a specially crafted WebSocket upgrade request containing a 64‑bit length field close to the maximum value, which is a feasible path for automated scanners or targeted adversaries.