TI-2025-10710 Aliases CVE-2025-11680 GHSA-7h7w-vjr9-r6m8

Out-of-bounds Write in libwebsockets PNG parsing

LOW 27CWE-787Published 2025-10-20 · Updated 2025-10-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to write past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big width value that causes an integer overflow which value is used for determining the size of a heap allocation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00394 33rd percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
warmcat	libwebsockets	4.0 – 4.4.2; 4.0 – 4.3.6	—	No fix listed	CNA

libwebsockets Vendorwarmcat Affected 4.0 – 4.4.2; 4.0 – 4.3.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Interconnect 1	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 17.1	Affected	No fix yet: Fix deferred
Red Hat Service Interconnect 2	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-11680
2026-10-03 Alias added: GHSA-7h7w-vjr9-r6m8

References

Patch 1

https://libwebsockets.org/git/libwebsockets/commit?id=2b715249f39291c86443b969a1088d59b6a89b78

Advisory 1

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11680

TI-2026-54362 warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write CVSS 4.0MEDIUM 6.9
TI-2026-09152 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption CVSS 4.0MEDIUM 6.9
TI-2025-01611 Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets CVSS 4.0CRITICAL 10.0
TI-2025-10708 Stack-based Buffer Overflow in libwebsockets DNS response parsing CVSS 4.0HIGH 7.5
TI-2025-10707 Use After Free in libwebsockets WebSocket server CVSS 4.0MEDIUM 6.3
TI-2025-10709 Out-of-bounds Read in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences