CVE-2026-78161 is an out-of-bounds write vulnerability found in warmcat libwebsockets version 4.5.0, specifically in the report_raw_cbor function within the lib/misc/lecp.c file of the LECP CBOR Recording component. This vulnerability allows remote attackers to manipulate memory, potentially leading to integrity and availability impacts. The vulnerability has been assigned a CVSS v3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. A patch has been identified (commit 1d44554a1bb262db63ff4e240152a9deecd99054) to address the issue. Exploit code has been publicly disclosed, but no known exploits in the wild have been reported.

The vulnerability enables remote attackers to perform out-of-bounds writes, which can compromise the integrity and availability of the affected system. Confidentiality impact is limited but present. The flaw can be exploited without authentication or user interaction, increasing the risk of exploitation. However, no active exploitation in the wild has been confirmed.

A patch addressing this vulnerability has been identified (commit 1d44554a1bb262db63ff4e240152a9deecd99054). It is recommended to apply this patch promptly to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch to affected deployments. Monitor official vendor or project advisories for the release of an official fix and further guidance.