CVE-2026-78161: Out-of-bounds Write in warmcat libwebsockets

An out-of-bounds write vulnerability was discovered in warmcat libwebsockets 4.5.0, specifically in the report_raw_cbor function of the lib/misc/lecp.c file, part of the LECP CBOR Recording component. This vulnerability allows remote attackers to write outside the intended memory bounds, potentially leading to memory corruption. The vulnerability is remotely exploitable without requiring privileges or user interaction. A patch identified by commit 1d44554a1bb262db63ff4e240152a9deecd99054 is available to fix the issue. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low to low integrity and availability impacts.

The vulnerability allows remote attackers to perform out-of-bounds memory writes, which can lead to memory corruption and potentially affect the integrity and availability of the affected system. The CVSS score of 6.9 reflects a medium severity impact. There is no confirmed exploitation in the wild, but public exploit code exists.

A patch identified by commit 1d44554a1bb262db63ff4e240152a9deecd99054 is available and should be applied to resolve this vulnerability. Applying this patch is the recommended remediation. No additional mitigation steps are specified by the vendor advisory.