The baresip re library's websock_decode() function in src/websock/websock.c contains an integer overflow vulnerability prior to version 4.8.1. When validating a masked WebSocket frame using 64-bit extended length encoding, the expression '4 + hdr->len' can wrap around if hdr->len is near UINT64_MAX. This causes the bounds check mbuf_get_left() to incorrectly pass, leading to a heap buffer overflow during the XOR unmasking loop. Applications using websock_accept() or websock_accept_proto() to implement WebSocket servers are affected. Exploitation can result in attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. The vulnerability is addressed in version 4.8.1.

Exploitation of this vulnerability can cause heap buffer overflow leading to attacker-controlled heap corruption or denial of service in applications using the affected baresip re library versions. This occurs after the HTTP WebSocket upgrade handshake, impacting WebSocket server implementations that rely on websock_accept() or websock_accept_proto().

This vulnerability is fixed in baresip re version 4.8.1. Users should upgrade to version 4.8.1 or later to remediate this issue. No additional mitigation steps are indicated.