CVE-2025-11679 Overview
CVE-2025-11679 is an out-of-bounds read vulnerability in the lws_upng_emit_next_line function of warmcat libwebsockets. The flaw affects builds compiled with the LWS_WITH_UPNG flag when the HTML display stack is in use. An attacker can trigger the condition by hosting a crafted PNG file with an oversized height dimension on a website. When a victim visits the attacker-controlled site, the library reads past a heap-allocated buffer, potentially causing a process crash. The vulnerability is classified under [CWE-125] Out-of-Bounds Read.
Critical Impact
A crafted PNG with a large height dimension causes libwebsockets to read past a heap allocation, resulting in a denial of service against the consuming application.
Affected Products
- warmcat libwebsockets compiled with LWS_WITH_UPNG enabled
- Applications using the libwebsockets HTML display stack
- Embedded and IoT devices bundling vulnerable libwebsockets builds
Discovery Timeline
- 2025-10-20 - CVE-2025-11679 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11679
Vulnerability Analysis
The vulnerability resides in the micro PNG (uPNG) decoder shipped with libwebsockets. The lws_upng_emit_next_line function emits decoded scanlines from a PNG image into a heap-allocated line buffer. When the PNG header declares a height larger than the buffer can accommodate, the decoder continues to advance its read position beyond the allocation boundary. The resulting out-of-bounds read can access adjacent heap memory, which typically manifests as a crash of the host application.
The issue is only reachable when libwebsockets is compiled with the LWS_WITH_UPNG flag and the HTML display stack renders remote image content. This configuration is common in embedded firmware and IoT devices that use libwebsockets to render lightweight web UIs. Exploitation requires user interaction because the victim must visit a page that instructs the client to fetch the malicious PNG.
Root Cause
The root cause is missing bounds validation on the PNG image height field before the decoder iterates over image rows. The decoder trusts the attacker-controlled dimension value and does not verify that read offsets remain within the allocated line buffer. This falls into the [CWE-125] Out-of-Bounds Read category.
Attack Vector
The attack vector is network-based with required user interaction. An attacker crafts a PNG file that declares a height value larger than what the decoder allocates for its working buffer. The attacker then serves the PNG from a website they control. When a victim using an application built on vulnerable libwebsockets navigates to that site, the HTML display stack invokes the uPNG decoder, which reads past the heap buffer and crashes the process.
No synthetic exploit code is available for this advisory. Refer to the libwebsockets Commit Details and the Nozomi Networks CVE-2025-11679 Advisory for technical specifics.
Detection Methods for CVE-2025-11679
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes linking libwebsockets when rendering web content
- HTTP responses delivering PNG files with abnormally large declared height values in the IHDR chunk
- Repeated navigation events from embedded browsers to unfamiliar external hosts followed by process restarts
Detection Strategies
- Inspect PNG IHDR chunks at network egress or proxy layer for height values that exceed expected UI rendering ranges
- Audit deployed binaries for libwebsockets versions compiled with the LWS_WITH_UPNG flag
- Monitor application crash telemetry from IoT and embedded devices for signatures involving lws_upng_emit_next_line
Monitoring Recommendations
- Enable core dump collection on devices that render web content through libwebsockets and forward stack traces to a central log store
- Alert on repeated crashes of the same process on the same device within short time windows
- Track outbound DNS and HTTP requests initiated by embedded rendering components to identify contact with untrusted origins
How to Mitigate CVE-2025-11679
Immediate Actions Required
- Inventory all applications and firmware images that bundle libwebsockets with LWS_WITH_UPNG enabled
- Apply the upstream fix referenced in the libwebsockets Commit Details and rebuild affected binaries
- Restrict the origins that embedded HTML display stacks are permitted to load until patched builds are deployed
Patch Information
The upstream project addressed the out-of-bounds read in commit 7df24cca7144d7bc9233b6b0a71108bd154ce101. Vendors that ship libwebsockets in firmware should rebuild against a patched revision and issue updates to affected devices. Consult the Nozomi Networks CVE-2025-11679 Advisory for additional guidance.
Workarounds
- Rebuild libwebsockets without the LWS_WITH_UPNG flag if PNG rendering through the HTML display stack is not required
- Disable the HTML display stack in configurations that do not require it
- Constrain the destinations reachable by embedded browsers using egress filtering or allow-lists
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
