CVE-2026-78161: libwebsockets Buffer Overflow Vulnerability

CVE-2026-78161 Overview

CVE-2026-78161 is an out-of-bounds write vulnerability in warmcat libwebsockets version 4.5.0. The flaw resides in the report_raw_cbor function within lib/misc/lecp.c, part of the LECP CBOR Recording component. Manipulation of input processed by the CBOR parser can trigger a write beyond the intended buffer boundaries. The vulnerability is remotely reachable over the network without authentication or user interaction. A public proof-of-concept exploit exists, increasing exposure for unpatched deployments. The maintainers addressed the issue in commit 1d44554a1bb262db63ff4e240152a9deecd99054. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
A remote attacker can trigger memory corruption in applications embedding libwebsockets 4.5.0 by supplying crafted CBOR data to the LECP recording path.

Affected Products

warmcat libwebsockets 4.5.0
Applications and firmware embedding the vulnerable lecp.c CBOR recording component
IoT and embedded devices using libwebsockets for WebSocket connectivity

Discovery Timeline

2026-08-24 - CVE-2026-78161 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78161

Vulnerability Analysis

The vulnerability exists in the report_raw_cbor function inside lib/misc/lecp.c. This function is part of the LECP (Lightweight Embedded CBOR Parser) recording path in libwebsockets. The bug allows an out-of-bounds write triggered by manipulation of CBOR-encoded input during parsing. Because CBOR data typically arrives over the network via WebSocket messages or related transports, the attacker does not require local access or authentication. Memory corruption of this class can lead to process crashes, data integrity issues, and — depending on adjacent memory layout — arbitrary code execution paths in embedded targets.

Root Cause

The root cause is incorrect ordering of operations around the ctx->cbor_pos counter. The original code invoked the LECP callback before resetting cbor_pos, allowing the counter to remain in an inconsistent state during callback execution. In corner cases this permitted writes past the end of the CBOR staging buffer. The fix reorders the reset to occur before the callback runs, closing the window in which stale position state could drive an out-of-bounds write.

Attack Vector

An unauthenticated remote attacker sends crafted CBOR input that reaches an application built against vulnerable libwebsockets 4.5.0 with LECP CBOR recording enabled. The malformed payload drives report_raw_cbor into the vulnerable code path and writes outside the intended buffer bounds. The attack does not require user interaction and can be launched over any network reachable transport that funnels CBOR data into LECP.

// Security patch in lib/misc/lecp.c - cbor: overflow
// Source: https://github.com/warmcat/libwebsockets/commit/1d44554a1bb262db63ff4e240152a9deecd99054
 	if (!ctx->cbor_pos)
 		return 0;
 
+	ctx->cbor_pos = 0;                /* reset BEFORE callback */
+
 	if (pst->cb(ctx, LECPCB_LITERAL_CBOR))
 		return 1;
 
-	ctx->cbor_pos = 0;
-
 	return 0;
 }

The patch moves the ctx->cbor_pos = 0 reset to occur before invoking pst->cb(ctx, LECPCB_LITERAL_CBOR), ensuring the position counter cannot be reused in an inconsistent state during callback execution.

Detection Methods for CVE-2026-78161

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption reports in processes linking libwebsockets 4.5.0
Malformed or oversized CBOR payloads arriving on WebSocket endpoints that terminate in LECP parsing
Repeated connection resets from a single remote source paired with CBOR-encoded traffic

Detection Strategies

Inventory binaries and container images to identify any application statically or dynamically linking libwebsockets 4.5.0 with LECP CBOR recording enabled
Deploy runtime memory-safety tooling such as AddressSanitizer or hardened allocators in test environments to catch the out-of-bounds write during fuzzing
Monitor for the public proof-of-concept referenced in the GitHub PoC repository and add signatures for its distinctive payload structure

Monitoring Recommendations

Log and alert on CBOR parsing errors and abnormal callback invocation patterns from WebSocket subsystems
Track process crash telemetry on IoT and embedded gateways that terminate WebSocket traffic
Correlate WebSocket traffic anomalies with post-crash restarts of services embedding libwebsockets

How to Mitigate CVE-2026-78161

Immediate Actions Required

Identify all deployed software and firmware images that bundle libwebsockets 4.5.0
Rebuild and redeploy affected applications with the patched source containing commit 1d44554a1bb262db63ff4e240152a9deecd99054
Restrict network exposure of WebSocket services that accept CBOR input until patches are deployed

Patch Information

The fix is available upstream in the warmcat/libwebsockets repository via the commit 1d44554a1bb262db63ff4e240152a9deecd99054. Vendors shipping devices or applications built against libwebsockets 4.5.0 should incorporate this commit or upgrade to a subsequent release that includes it. Additional context is available at VulDB CVE-2026-78161.

Workarounds

Disable LECP CBOR recording code paths at build time if the feature is not required
Enforce strict size and structural validation of CBOR payloads at an upstream proxy before they reach the vulnerable parser
Apply network segmentation and firewall rules to limit which peers can send CBOR data to services embedding libwebsockets

bash

# Rebuild libwebsockets from a patched source tree
git clone https://github.com/warmcat/libwebsockets.git
cd libwebsockets
git checkout 1d44554a1bb262db63ff4e240152a9deecd99054
mkdir build && cd build
cmake .. -DLWS_WITH_LECP=ON
make && sudo make install