The baresip re library's websock_decode() function in src/websock/websock.c contains an integer overflow vulnerability prior to version 4.8.1. Specifically, the expression 4 + hdr->len can wrap around when hdr->len approaches UINT64_MAX, bypassing the mbuf_get_left() bounds check. This leads to a heap buffer overflow during the XOR unmasking loop of masked WebSocket frames with 64-bit extended length encoding. Applications using websock_accept() or websock_accept_proto() to implement WebSocket servers are affected. Successful exploitation can result in attacker-controlled heap corruption or denial of service following the HTTP WebSocket upgrade handshake. The vulnerability is addressed in version 4.8.1.

An attacker can exploit this vulnerability to cause heap corruption or denial of service in applications using the affected baresip re library versions. This can lead to application crashes or potentially allow further exploitation due to corrupted memory. The vulnerability affects WebSocket server implementations that use websock_accept() or websock_accept_proto().

Upgrade to baresip re version 4.8.1 or later, where this integer overflow and heap buffer overflow vulnerability has been fixed. No other mitigation or temporary workaround is indicated.