libwebsockets Vulnerability Allows Remote Code Execution via Crafted MQTT Packets
A critical vulnerability in libwebsockets' MQTT protocol handling allows unauthenticated remote attackers to execute arbitrary code by sending a specially crafted PUBACK packet.
A critical remote code execution (RCE) vulnerability has been identified in the libwebsockets library, specifically within its handling of MQTT protocol PUBACK packets. This flaw, tracked as CVE-2026-114550, allows unauthenticated attackers to compromise affected systems by sending a malformed packet.
The vulnerability stems from a lack of proper validation of user-supplied data during the processing of PUBACK packets. This oversight leads to a buffer overflow condition, where an attacker can write data beyond the boundaries of an allocated buffer. Successful exploitation enables an attacker to execute arbitrary code within the context of the running process, posing a significant security risk.
With a CVSS score of 8.1, this vulnerability is rated as high severity. The ability for an attacker to achieve code execution without requiring any form of authentication makes it particularly dangerous, as it can be exploited remotely over a network connection.
The libwebsockets project has acknowledged the vulnerability and has released an update to address the issue. Developers are strongly advised to update their installations of libwebsockets to the patched version to mitigate the risk of exploitation. The fix can be found in the project's repository.
Details of the fix are available via a commit in the libwebsockets GitHub repository, specifically at https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c.
The vulnerability was initially reported to the vendor on July 16, 2026. Following coordinated disclosure efforts, the advisory was publicly released on October 26, 2026, with an update to the advisory also published on the same date.
This vulnerability highlights the ongoing challenges in securing widely used networking libraries. Developers and system administrators must remain vigilant in applying security patches promptly, especially for components handling network protocols that are exposed to external input.