This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-78161 →
DEBIAN-CVE-2026-78161
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP C...
Original description
The description as published by the source.
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:13
libwebsockets
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1+deb13u2"}]}]
Debian:14
libwebsockets
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-6"}]}]
References
- advisory security-tracker.debian.org