TI-2025-10709 Aliases CVE-2025-11679 GHSA-q5q2-4x99-gg9p

Out-of-bounds Read in libwebsockets PNG parsing

LOW 27CWE-125Published 2025-10-20 · Updated 2025-10-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
warmcat	libwebsockets	4.0 – 4.4.2; 4.0 – 4.3.6	—	No fix listed	CNA

libwebsockets Vendorwarmcat Affected 4.0 – 4.4.2; 4.0 – 4.3.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Interconnect 1	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 17.1	Affected	No fix yet: Fix deferred
Red Hat Service Interconnect 2	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-11679
2026-10-03 Alias added: GHSA-q5q2-4x99-gg9p

References

Patch 1

https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce101

Advisory 1

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11679

TI-2026-54362 warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write CVSS 4.0MEDIUM 6.9
TI-2026-09152 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption CVSS 4.0MEDIUM 6.9
TI-2025-01611 Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets CVSS 4.0CRITICAL 10.0
TI-2025-10708 Stack-based Buffer Overflow in libwebsockets DNS response parsing CVSS 4.0HIGH 7.5
TI-2025-10707 Use After Free in libwebsockets WebSocket server CVSS 4.0MEDIUM 6.3
TI-2025-10710 Out-of-bounds Write in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences