Description
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
Published: 2026-08-24
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out-of-bounds write in the report_raw_cbor function of the LECP CBOR Recording component of warmcat libwebsockets, triggered by malformed CBOR data. The memory corruption can overwrite adjacent data and has the potential to lead to arbitrary code execution or denial of service. This flaw is categorized as CWE-119 and CWE-787, and can be exploited remotely against systems running the affected library.

Affected Systems

The flaw applies to warmcat libwebsockets version 4.5.0, specifically the file lib/misc/lecp.c. No other product versions are listed as affected, and the available patch is identified by commit 1d44554a1bb262db63ff4e240152a9deecd99054.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the publicly available exploit means a remote attacker can trigger the out-of-bounds write with crafted CBOR data. The EPSS score is not available, and the issue is not in the CISA KEV catalog, but the remote execution potential warrants urgent attention. Deploying the patch or disabling the vulnerable feature mitigates the risk.

Generated by OpenCVE AI on August 24, 2026 at 02:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch referenced by commit 1d44554a1bb262db63ff4e240152a9deecd99054 to libwebsockets 4.5.0 or upgrade to a newer release that includes the fix.
  • If the patch cannot be applied immediately, disable or limit the LECP CBOR Recording feature in the libwebsockets configuration to reduce exposure.
  • Implement network segmentation or firewall rules to restrict remote access to the components that use LECP CBOR Recording until the patch is deployed.

Generated by OpenCVE AI on August 24, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
Title warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
First Time appeared Warmcat
Warmcat libwebsockets
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:*
Vendors & Products Warmcat
Warmcat libwebsockets
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Warmcat Libwebsockets
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T00:45:08.842Z

Reserved: 2026-08-23T11:53:19.761Z

Link: CVE-2026-78161

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T01:16:57.360

Modified: 2026-08-24T01:16:57.360

Link: CVE-2026-78161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T02:30:10Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write