Vulnerability · Published Oct 20, 2025 · Assigned by Nozomi

CVE-2025-11679Out-of-bounds Read in libwebsockets PNG parsing

Medium 5.9

In plain English

A medium-severity out-of-bounds read in libwebsockets from warmcat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libwebsockets	no fix listed	DEBIAN-CVE-2025-11679
Debian:13	libwebsockets	no fix listed	DEBIAN-CVE-2025-11679
Debian:14	libwebsockets	no fix listed	DEBIAN-CVE-2025-11679
Ubuntu:22.04:LTS	libwebsockets	no fix listed	UBUNTU-CVE-2025-11679
Ubuntu:24.04:LTS	libwebsockets	no fix listed	UBUNTU-CVE-2025-11679
Ubuntu:25.10	libwebsockets	no fix listed	UBUNTU-CVE-2025-11679

Affected products (as reported)

Vendor	Product	Versions
warmcat	libwebsockets	4.0 – through 4.4.24.0 – through 4.3.6

Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce101 patch, vendor-advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11679 third-party-advisory