{"id":"CVE-2026-114550","kind":"vulnerability","aliases":["CVE-2026-114550"],"related":[],"title":"libwebsockets: MQTT PUBACK handling lets remote attackers run code","description":"libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.","summary":"libwebsockets mishandles incoming MQTT PUBACK packets and writes past the end of an allocated buffer. A remote attacker who sends a crafted packet can execute arbitrary code in the context of the affected process.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","iot","libwebsockets","mqtt","runtime"],"not_affected_if":["mqtt-disabled","no-untrusted-network-input"],"how_to_check":"- Check whether your build or firmware links libwebsockets and was built with MQTT support (LWS_ROLE_MQTT / LWS_WITH_MQTT in the CMake config).\n- Check whether the libwebsockets source you build from contains commit c9e8e18 (git merge-base --is-ancestor c9e8e1834d7f13038c82963086b90e2ee9c5b44c HEAD). If it does not, treat it as vulnerable.\n- Also check embedded or vendor firmware that bundles libwebsockets: the vendor must ship the fix.","fix":"Fixed in source by commit c9e8e1834d7f13038c82963086b90e2ee9c5b44c on warmcat/libwebsockets main (2026-07-17). No release version is named by the sources; build from a tree that includes that commit, or wait for a tagged release.","status":"open","published_at":"2026-11-04T00:17:22+00:00","first_seen_at":"2026-11-04T00:46:15+00:00","triaged_at":"2026-11-04T00:47:46+00:00","updated_at":"2026-11-04T00:54:48+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T00:47:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"libwebsockets: MQTT PUBACK handling lets remote attackers run code","impact":"high","summary":"libwebsockets mishandles incoming MQTT PUBACK packets and writes past the end of an allocated buffer. A remote attacker who sends a crafted packet can execute arbitrary code in the context of the affected process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["libwebsockets","mqtt","c","iot"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code in the affected process over the network","analyst_note":"Find the affected and fixed libwebsockets versions and the MQTT configuration from the NVD entry and the linked patch on github.com.","how_to_check":"- Check whether the application links libwebsockets and uses its MQTT client support, for example by searching the build for `libwebsockets`\n- Confirm the installed libwebsockets version with `unknown` if the sources do not name a fixed version","plain_action":"","needs_analyst":true,"not_affected_if":["mqtt-disabled","no-untrusted-network-input"],"who_is_affected":"Systems that use libwebsockets with its MQTT protocol support and accept packets from the network are the ones to look at. Applications that do not use the MQTT feature or that never receive untrusted network traffic are less exposed. The sources do not name the affected versions or the default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4254,"output_tokens":544,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed libwebsockets versions and the MQTT configuration from the NVD entry and the linked patch on github.com.","search":"'-114550':12A,15A '-2026':11A,14A '31039':149C 'affect':53B,80C 'alloc':34B,127C 'allow':72C 'arbitrari':46B,77C 'attack':7A,38B,74C,130C 'authent':84C 'bound':64C 'buffer':35B,128C 'c':16B 'code':9A,47B,67C,78C,137C 'context':50B,140C 'craft':42B 'current':143C 'cve':10A,13A 'data':115C 'end':31B,124C 'execut':45B,68C,76C,136C 'exist':95C 'exploit':89C 'flaw':94C 'handl':4A,60C,98C 'incom':23B 'instal':81C 'iot':17B 'issu':103C 'lack':107C 'let':5A 'leverag':132C 'libwebsocket':1A,18B,21B,55C,83C 'mishandl':22B 'mqtt':2A,19B,24B,56C 'out-of-bound':61C 'packet':26B,43B,59C,101C 'past':29B,122C 'process':54B,144C 'proper':109C 'protocol':57C 'puback':3A,25B,58C,100C 'remot':6A,37B,66C,73C 'requir':87C 'result':104C,118C 'run':8A 'runtim':20B 'send':40B 'specif':93C 'suppli':114C 'user':113C 'user-suppli':112C 'valid':110C 'vulner':69C,71C,91C,134C 'within':96C 'write':28B,65C,121C 'zdi':147C 'zdi-can':146C","nicknames":[],"mitigations":[],"who_affected":"Applications and devices that use libwebsockets with its MQTT role enabled and process MQTT PUBACK packets from a peer (client talking to a broker, or any MQTT traffic an attacker can inject) are exposed. Look at IoT gateways, embedded firmware and C services that bundle libwebsockets. Builds without MQTT support, or that never connect to untrusted MQTT peers, can skip it. The affected version range is not stated by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","high","iot","libwebsockets","mqtt","runtime"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114550","severity":null,"published_at":"2026-11-04T00:17:22+00:00","modified_at":"2026-11-04T00:17:22+00:00","first_seen_at":"2026-11-04T00:46:15+00:00","fetched_at":"2026-11-04T00:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114550:1610","url":null,"severity":null,"published_at":"2026-11-04T00:54:48+00:00","modified_at":"2026-11-04T00:54:48+00:00","first_seen_at":"2026-11-04T00:54:48+00:00","fetched_at":"2026-11-04T00:54:48+00:00","note":"ZDI-26-792 and the lws commit c9e8e18 (2026-07-17, lib/roles/mqtt/mqtt.c, one file, +1/-2, 'enter wrong state' in PUBACK properties-length VBI handling) confirm the bug. Neither names an affected range or a release containing the fix. v4.5.8 (Mar 2026) predates the commit, so it likely does not include it; I did not confirm this. Nothing marked verified. Not exploited, no PoC seen."}],"documents":[{"id":62106,"url":"https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":62186,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-792/","title":"ZDI-26-792 libwebsockets MQTT PUBACK OOB write","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}