ZDI-CAN-31039: ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Oct 26, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.

Affected Software

1 affected component

libwebsockets libwebsockets

Event History

Oct 26, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Affected libwebsockets installations should be prioritized because the issue can allow remote code execution without authentication. The provided data does not identify affected versions or configuration conditions.

Does an attacker need valid credentials to exploit this issue?

No. Authentication is not required for exploitation.

ZDI-CAN-31039: ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does an attacker need valid credentials to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does an attacker need valid credentials to exploit this issue?