Bug 2405135 (CVE-2025-11680)

Summary: CVE-2025-11680 libwebsockets: Out-of-bounds Write in libwebsockets PNG parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ansmith, eglynn, jjoyce, jschluet, lhh, lsvaty, mburns, mgarciac, peholase, pgrist, pjindal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An out of bounds write flaw has been discovered in how libwebsockets handles PNG files. The issue is caused by the initialization of `bypl` struct member, whenever the multiplication of width by bypp overflows, resulting in `bypl` being 0, later on the buffer `u->inf.out` will only be allocated a buffer of size `u->inf.info_size` and the buffer `u->u.lines` will then point right after the end of the allocated buffer, thus any subsequent operation on the lines buffer will write or read past heap allocated memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2405258, 2405259, 2405260, 2405261, 2405262    
Bug Blocks:    

Description OSIDB Bzimport 2025-10-20 17:23:58 UTC 
Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to write past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big width value that causes an integer overflow which value is used for determining the size of a heap allocation.