CVE-2025-11680: libwebsockets Buffer Overflow Vulnerability

CVE-2025-11680 Overview

CVE-2025-11680 is an out-of-bounds write vulnerability [CWE-787] in the unfilter_scanline function of warmcat libwebsockets. The flaw affects builds compiled with the LWS_WITH_UPNG flag when the HTML display stack is used. A crafted Portable Network Graphics (PNG) file with an oversized width value triggers an integer overflow. The overflowed value is then used to size a heap allocation, causing the decoder to write past the buffer boundary.

Critical Impact
A user visiting an attacker-controlled website that serves a malicious PNG can trigger a heap buffer write, resulting in application crash and potential memory corruption within libwebsockets-based HTML display clients.

Affected Products

warmcat libwebsockets builds compiled with LWS_WITH_UPNG enabled
Applications embedding the libwebsockets HTML display stack
Downstream products bundling vulnerable libwebsockets versions for PNG rendering

Discovery Timeline

2025-10-20 - CVE-2025-11680 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11680

Vulnerability Analysis

The vulnerability resides in unfilter_scanline, a routine within the micro-PNG (uPNG) decoder integrated into libwebsockets when compiled with LWS_WITH_UPNG. The decoder parses the PNG IHDR chunk and uses the reported image width to compute the size of a heap buffer for scanline unfiltering.

When the width field carries an unusually large value, the size calculation overflows a fixed-width integer. The truncated result produces a small allocation, while later loop bounds continue to reference the attacker-controlled width. The mismatch causes unfilter_scanline to write beyond the allocated buffer while processing the filtered scanline bytes.

Exploitation requires the target application to render a PNG delivered by an attacker, typically through the HTML display stack. User interaction is required, as noted by the UI:A attribute in the CVSS 4.0 vector. Successful triggering primarily results in a denial-of-service condition through process crash, though heap corruption may extend the impact depending on the surrounding allocator state.

Root Cause

The root cause is an integer overflow during the buffer-size calculation used by unfilter_scanline. The overflowed value is passed to a heap allocator without validation against subsequent scanline write loops, producing an undersized destination for attacker-controlled image data.

Attack Vector

An attacker hosts a crafted PNG on a controlled web page. When a client built on libwebsockets with LWS_WITH_UPNG navigates to that page, the HTML display stack fetches and decodes the image, invoking the vulnerable code path. No authentication is required, but the victim must load the attacker-supplied content.

The vulnerability manifests in the uPNG scanline unfiltering routine. See the libwebsockets commit and the Nozomi Networks advisory for technical details on the fix and the malformed IHDR width required to trigger the overflow.

Detection Methods for CVE-2025-11680

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libwebsockets while rendering web content
PNG files served from untrusted origins containing IHDR width values approaching or exceeding 32-bit limits
Core dumps referencing unfilter_scanline or nearby uPNG decoder frames

Detection Strategies

Inspect binaries and packages for libwebsockets versions predating commit 2b715249f39291c86443b969a1088d59b6a89b78 with LWS_WITH_UPNG enabled
Deploy PNG validation at web proxies to reject images with malformed or oversized IHDR width fields
Monitor endpoint telemetry for repeated crashes of applications embedding the libwebsockets HTML display stack

Monitoring Recommendations

Aggregate application crash telemetry and correlate faulting modules against known libwebsockets consumers
Alert on outbound requests to newly registered domains immediately preceding crashes in HTML-rendering clients
Track software bill of materials (SBOM) entries to identify products bundling vulnerable libwebsockets releases

How to Mitigate CVE-2025-11680

Immediate Actions Required

Update libwebsockets to a version containing commit 2b715249f39291c86443b969a1088d59b6a89b78 or later
Audit build configurations and disable LWS_WITH_UPNG where the HTML display stack and PNG rendering are not required
Restrict browsing from affected clients to trusted domains until patches are deployed

Patch Information

The upstream fix is available in the warmcat libwebsockets repository. Review the libwebsockets commit for the code change addressing the integer overflow in unfilter_scanline. Downstream vendors that ship libwebsockets should be tracked for backported releases and coordinated updates.

Workarounds

Rebuild libwebsockets without the LWS_WITH_UPNG flag when PNG decoding is not required by the application
Avoid using the HTML display stack in libwebsockets-based clients that process untrusted image content
Filter or sanitize PNG assets at an upstream proxy, rejecting files with IHDR width fields that could trigger the overflow

bash

# Rebuild libwebsockets without the vulnerable uPNG decoder
cmake .. -DLWS_WITH_UPNG=OFF
make && sudo make install