libwebsockets MQTT PUBACK handling flaw allows unauthenticated RCE
Original title: ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
ZDI rates CVE-2026-114550 at 8.1; no login is required, and no fixed version is named.
ZDI published ZDI-26-792, an out-of-bounds write in libwebsockets while handling MQTT PUBACK packets. Remote attackers can execute arbitrary code without authentication. ZDI assigned CVSS 8.1 and CVE-2026-114550. Affected and fixed versions and exploitation status are not stated.
Unconfirmed: Affected versions, a fix, and whether attackers exploit it are not stated.
- The advisory id is ZDI-26-792.
- The flaw is an out-of-bounds write in MQTT PUBACK handling.
- Authentication is not required.
- The assigned identifier is CVE-2026-114550.
Impact: Unauthenticated remote arbitrary code execution
| Product | Affected |
|---|---|
| libwebsockets | — |
- CVEs
- CVE-2026-114550
- Products
- libwebsockets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114550 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.