CVE-2025-11679CWE-125

CVE-2025-11679

published October 20, 2025

CVSS
5.9
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.

The record
Technical detail
CVSS
5.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-10-20T18:15Z
References (2)
https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce101 · [email protected]https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11679 · [email protected]
EPSS history
Timeline
  • 20 OCT 13:58Z
    Out-of-bounds Read in libwebsockets PNG parsing
    cvelistv5