ZDI 2026-10-26

ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2026-114550

Machine-generated analysis · WAYSCloud LLM

Unauthenticated remote code execution is possible via an out-of-bounds write in libwebsockets' MQTT PUBACK handling.

Context

The advisory concerns the libwebsockets library. It describes an out-of-bounds write in MQTT PUBACK packet handling that can lead to remote code execution. Exploitation does not require authentication. The advisory assigns a CVSS base score of 8.1.

Operator considerations

Check: verify the libwebsockets version deployed.
Isolate: segment or restrict services using libwebsockets until a fix is available.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.

Read the full advisory on ZDI →