CVE-2026-78161
Received Received - Intake

Out-of-Bounds Write in libwebsockets LECP CBOR Recording

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78161
EUVD
EUVD-2026-64685

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
warmcat libwebsockets 4.5.0
warmcat libwebsockets 4.5.99-v4.5.0-508-gb4b5aed39

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78161 is an out-of-bounds write vulnerability in the libwebsockets library affecting the LECP CBOR Recording component. The flaw occurs in the lecp_parse function where a byte is written to a buffer before checking if the buffer is full. If the buffer is full and a callback rejects raw CBOR data, the next byte overflows into adjacent memory, corrupting the lecp_item structure. This allows attackers to write controlled byte values into memory, potentially causing type confusion or misinterpretation of CBOR data.

Detection Guidance

To detect CVE-2026-78161, check the version of libwebsockets installed on your system. If it is version 4.5.0 or affected versions, the vulnerability may be present. Use commands like 'dpkg -l | grep libwebsockets' on Debian-based systems or 'rpm -qa | grep libwebsockets' on RPM-based systems to check the installed version.

Impact Analysis

This vulnerability can be exploited remotely if an application parses untrusted CBOR data with literal reporting enabled. Attackers could corrupt memory, leading to crashes, data corruption, or arbitrary code execution. The impact depends on the application's use of libwebsockets but could include denial of service, privilege escalation, or data breaches if exploited successfully.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data access or modification. An out-of-bounds write in CBOR parsing may allow attackers to corrupt memory, leading to data breaches or integrity violations. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Exploitation of this flaw could violate these requirements.

Mitigation Strategies

Apply the patch provided in commit 1d44554a1bb262db63ff4e240152a9deecd99054 from the libwebsockets repository. Update to the latest version of libwebsockets that includes this fix. If immediate patching is not possible, disable CBOR parsing or disable the LECP component if your application does not require it.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart