ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
// AI summary
libwebsockets has CVE-2026-114550, an out-of-bounds write in MQTT Protocol PUBACK packet handling allowing remote attackers to execute arbitrary code without authentication.
// from the source
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.