This vulnerability in libwebsockets arises from a lack of proper validation in the HTTP/2 HPACK path header parsing logic, leading to an out-of-bounds write condition. An attacker can exploit this flaw to execute arbitrary code within the context of the affected process without requiring authentication. The CVSS v3.0 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the process running libwebsockets. No authentication is required, increasing the risk of exploitation. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider mitigating exposure by restricting access to services using libwebsockets or employing network-level protections.