Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-50161libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow

Critical 9.3

In plain English

A critical-severity integer overflow in re from baresip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.7%top 45.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libre	no fix listed	DEBIAN-CVE-2026-50161
Debian:13	libre	no fix listed	DEBIAN-CVE-2026-50161
Debian:14	libre	2.0.1-4	DEBIAN-CVE-2026-50161
Ubuntu:22.04:LTS	libre	no fix listed	UBUNTU-CVE-2026-50161
Ubuntu:24.04:LTS	libre	no fix listed	UBUNTU-CVE-2026-50161
Ubuntu:26.04:LTS	libre	no fix listed	UBUNTU-CVE-2026-50161
Ubuntu:26.10	libre	no fix listed	UBUNTU-CVE-2026-50161

Affected products (as reported)

Vendor	Product	Versions
baresip	re	< 4.8.1

Weakness: CWE-190, CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/baresip/re/security/advisories/GHSA-hvxv-v2gp-v93h x_refsource_CONFIRM
https://github.com/baresip/re/pull/1584 x_refsource_MISC
https://github.com/baresip/re/commit/718b92615c7963670d26c1a2b246968b58d782e8 x_refsource_MISC
https://github.com/baresip/re/releases/tag/v4.8.1 x_refsource_MISC