Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-114550 EUVD-2026-116626GHSA-64rj-2w6g-r32v

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Nov 3, 2026 · Updated Nov 6, 2026 · Assigned by zdi

Vendor: libwebsockets Product: libwebsockets Package: libwebsockets Package: libwebsockets Ecosystem: Debian Ecosystem: Ubuntu

Description

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Affected products

VendorProductAffectedFixed
libwebsockets libwebsockets b4b5aed3903eaff09cd76a410f69bbe5dff66f8e —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libwebsockets No fix yet —
Debian 13 libwebsockets No fix yet —
Debian 12 libwebsockets No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libwebsockets No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS libwebsockets No fix yet —
Ubuntu Pro 24.04 LTS libwebsockets No fix yet —
Ubuntu Pro 22.04 LTS libwebsockets No fix yet —
Ubuntu Pro 20.04 LTS libwebsockets No fix yet —
Ubuntu Pro 18.04 LTS libwebsockets No fix yet —
Ubuntu Pro 16.04 LTS libwebsockets No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • googlesky/CVE-2026-114550 ★ 0 · Nov 5, 2026

    CVE-2026-114550 / ZDI-CAN-31039: libwebsockets MQTT PUBACK OOB write PoC lab (podman)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References