Read the docs
TI-2025-01611 Aliases CVE-2025-1866GHSA-w9v7-r27g-jrmx

Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets

Priority MEDIUM 49CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Pointer Manipulation, potentially leading to out-of-bounds memory access. This issue affects libwebsockets before 4.3.4 and is present in code built specifically for the Win32 platform. By default, the affected code is not executed unless one of the following conditions is met: LWS_WITHOUT_EXTENSIONS (default ON) is manually set to OFF in CMake. LWS_WITH_HTTP_STREAM_COMPRESSION (default OFF) is manually set to ON in CMake. Despite these conditions, when triggered in affected configurations, this vulnerability may allow attackers to manipulate pointers, potentially leading to memory corruption or unexpected behavior.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • A-MQ Interconnect 1
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1866
  2. 2026-10-03 Alias added: GHSA-w9v7-r27g-jrmx

References

Patch 1

  • TI-2026-54362 warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write CVSS 4.0MEDIUM 6.9
  • TI-2026-09152 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption CVSS 4.0MEDIUM 6.9
  • TI-2025-10708 Stack-based Buffer Overflow in libwebsockets DNS response parsing CVSS 4.0HIGH 7.5
  • TI-2025-10707 Use After Free in libwebsockets WebSocket server CVSS 4.0MEDIUM 6.3
  • TI-2025-10710 Out-of-bounds Write in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9
  • TI-2025-10709 Out-of-bounds Read in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences