---
id: "CVE-2026-114550"
kind: "vulnerability"
aliases: ["CVE-2026-114550"]
title: "libwebsockets: MQTT PUBACK handling lets remote attackers run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["c", "iot", "libwebsockets", "mqtt", "runtime"]
not_affected_if: ["mqtt-disabled", "no-untrusted-network-input"]
published_at: "2026-11-04T00:17:22+00:00"
first_seen_at: "2026-11-04T00:46:15+00:00"
updated_at: "2026-11-04T00:54:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114550", "first_seen_at": "2026-11-04T00:46:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:54:48+00:00"}]
---

# libwebsockets: MQTT PUBACK handling lets remote attackers run code

libwebsockets mishandles incoming MQTT PUBACK packets and writes past the end of an allocated buffer. A remote attacker who sends a crafted packet can execute arbitrary code in the context of the affected process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your build or firmware links libwebsockets and was built with MQTT support (LWS_ROLE_MQTT / LWS_WITH_MQTT in the CMake config).
- Check whether the libwebsockets source you build from contains commit c9e8e18 (git merge-base --is-ancestor c9e8e1834d7f13038c82963086b90e2ee9c5b44c HEAD). If it does not, treat it as vulnerable.
- Also check embedded or vendor firmware that bundles libwebsockets: the vendor must ship the fix.

## Fix

Fixed in source by commit c9e8e1834d7f13038c82963086b90e2ee9c5b44c on warmcat/libwebsockets main (2026-07-17). No release version is named by the sources; build from a tree that includes that commit, or wait for a tagged release.

## Timeline

- 2026-11-04T00:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114550
- 2026-11-04T00:54:48+00:00 analyst — ZDI-26-792 and the lws commit c9e8e18 (2026-07-17, lib/roles/mqtt/mqtt.c, one file, +1/-2, 'enter wrong state' in PUBACK properties-length VBI handling) confirm the bug. Neither names an affected range or a release containing the fix. v4.5.8 (Mar 2026) predates the commit, so it likely does not include it; I did not confirm this. Nothing marked verified. Not exploited, no PoC seen.

## Documents

- [advisory] ZDI-26-792 libwebsockets MQTT PUBACK OOB write https://www.zerodayinitiative.com/advisories/ZDI-26-792/
- [fix] Patch: github.com https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c

## From the sources

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_