CVE-2026-114550: Remote Code Execution in libwebsockets MQTT

CVE-2026-114550 is an out-of-bounds write vulnerability in the libwebsockets library, widely used to implement the MQTT protocol in web, IoT, and connected system environments. The flaw exists in the unvalidated handling of PUBACK (Publish Acknowledgement) packets, allowing a remote attacker to write data beyond allocated memory buffer boundaries. This enables arbitrary code execution within the affected process context, without requiring authentication credentials.

The vulnerability is classified as critical for its unauthenticated remote code execution capability. Although the CVSS score has not yet been published by official authorities, the flaw type (RCE without credentials) places it at the highest severity level. Registration on NVD occurred on November 4, 2026, and by the following day public repositories appeared on GitHub claiming to contain exploits, indicating immediate visibility and potential exploitation in production environments.

Organizations deploying libwebsockets must immediately identify all instances in use, prioritizing systems exposed to untrusted networks. It is critical to continuously monitor official libwebsockets advisories for a corrective patch. In the interim, restrict MQTT service access exclusively to trusted networks, apply network segmentation and isolation, and evaluate temporary disabling of MQTT on non-essential applications to significantly reduce exploitation risk.

The absence of an official patch at publication time makes this vulnerability particularly critical for system administrators. The remote attack vector combined with no authentication prerequisites positions it as an absolute priority for those maintaining libwebsockets in production environments. Immediate inventory assessment and update planning are essential actions to reduce the risk of system compromise.