CVE-2026-114550: RCE in libwebsockets MQTT, One-Line Patch

On October 26, 2026, TrendAI Zero Day Initiative publicly disclosed a remote code execution vulnerability in the open-source libwebsockets library. The bug, tracked as CVE-2026-114550/ZDI-26-792 with a CVSS score of 8.1 per the ZDI published list, resides in the MQTT PUBACK packet parser and allows a remote attacker to overwrite memory without authentication. The fix has been available for months, but the library's prevalence in embedded firmware and IoT gateways points to prolonged exposure windows.

The Bug: When the State Machine Misses a Step

The core defect is a finite state machine error governing MQTT protocol parsing in libwebsockets. While processing PUBACK packets with properties, the parser fails to transition correctly from state LMQCPP_PUBACK_VH_PKT_ID to LMQCPP_EAT_PROPERTIES_AND_COMPLETE. This omission permits a write past the end of the allocated packet data buffer.

As documented in advisory ZDI-26-792, "The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer." The consequence is arbitrary code execution on the target system, with the same advisory clarifying: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability."

The pre-authentication nature of the bug is critical: the attacker needs no valid credentials or privileged network position, only the ability to send malformed MQTT PUBACK packets to an exposed endpoint.

A Three-Line Patch, Three Months of Waiting

libwebsockets maintainer Andy Green (warmcat) merged the fix in commit c9e8e18. The diff shows two lines removed and one added, with the commit message summarizing: "ZDI-CAN-31039: enter wrong state." The change explicitly enforces the missing state transition in the MQTT parser state machine, closing the memory corruption window.

The coordinated disclosure timeline is archived in the ZDI advisory: initial vendor notification on July 16, 2026, public release on October 26, 2026. The 102-day interval falls within standard responsible disclosure windows, but highlights the gap between fix availability and public communication: during this period, installations tracking the project's security channels already had access to the fix, while those dependent on vendor update cycles or embedded distribution repositories remained unaware.

Discovery is credited to a researcher who chose anonymity, with the official commit citing: "This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative."

libwebsockets: A Library at the Heart of the Edge

libwebsockets is a C library designed to handle WebSocket connections and related protocols, including MQTT, in resource-constrained environments. Its typical deployment spans embedded devices, IoT gateways, industrial control systems, and real-time applications where lightweight efficiency is paramount. This usage profile makes the library particularly insidious from a security standpoint: targets implementing it often lack automatic update mechanisms or centralized visibility into their exposure.

The vulnerability does not affect the WebSocket module itself, but the MQTT subsystem integrated into the library. This distinction matters for risk assessment: systems using libwebsockets exclusively for WebSocket, without enabling the MQTT broker or client, are not exposed to the documented attack surface. Conversely, devices exposing MQTT endpoints for telemetry, command-and-control, or cloud IoT platform integration are potentially vulnerable if unpatched.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability."
— Advisory ZDI-26-792, CVE-2026-114550

What to Do Now

• Identify installations with libwebsockets and the MQTT subsystem active: scan software inventory for the library's presence, focusing on services exposing standard or custom MQTT ports.
• Apply commit c9e8e18 or a later version that includes it: the patch is public and merged in the official repository; embedded distributions must be rebuilt with the fix.
• Assess network segmentation for IoT devices that cannot be updated immediately: restrict MQTT endpoint visibility to internal networks or VPNs, reducing the remote attack surface.
• Monitor logs for anomalous PUBACK packet patterns: MQTT requests with irregular structure or non-standard sizes may indicate reconnaissance or exploitation attempts.

Slowness as a Secondary Vulnerability

The technical lesson of CVE-2026-114550 lies not in the bug's complexity, but in its banality. A missing state transition in a finite state machine is the type of error code reviewers are trained to catch, yet in binary protocol parsers it can slip through due to implicit states and edge conditions unexercised by regression tests. The fact that the fix requires a single line does not diminish severity; it increases it, because it lowers the barrier for anyone analyzing the diff to reconstruct the trigger.

The more relevant issue for the reader is not the technical backstory, but the risk geometry it creates. libwebsockets powers software packaged into firmware, sealed in devices, distributed through opaque supply chains. In this ecosystem, a patch on GitHub does not equal a patch in the field. The gap between coordinated disclosure and effective mitigation measures in months or years, not days. And while official timelines close with the advisory release, the bottom half of the story — the updates that will never arrive — begins right now.

FAQ

Does the vulnerability affect all libwebsockets installations?

No. The bug is specific to the MQTT PUBACK parser. Systems using libwebsockets exclusively for WebSocket, without enabling MQTT functionality, are not exposed to the documented attack surface.

Is there an official CVE for this flaw?

Yes, CVE-2026-114550, assigned and published in advisory ZDI-26-792. The CVE is confirmed by the primary source.

Is the full CVSS vector available?

The ZDI-26-792 textual advisory does not include the detailed CVSS vector. The published ZDI list assigns the vulnerability a score of 8.1.

Sources

• zerodayinitiative.com
• zerodayinitiative.com
• github.com