CVE-2026-50161 baresip CVE debrief

Who should care

Defenders who use the libre library for real-time communications with asynchronous input and output support should care about this vulnerability. They should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-50161 is a critical vulnerability in the libre library that can cause heap corruption or denial of service. Defenders who use the libre library for real-time communications with asynchronous input and output support should care about this vulnerability and prioritize patching or mitigating it.

• Heap corruption or denial of service after the HTTP WebSocket upgrade handshake
• Potential for attacker-controlled heap corruption
• Possible disruption of real-time communication services

Technical summary

The vulnerability exists in the websock_decode() function in src/websock/websock.c and can cause an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. This can lead to heap corruption or denial of service after the HTTP WebSocket upgrade handshake. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as it can lead to heap corruption or denial of service.

Recommended defensive actions

• Patch or upgrade to version 4.8.1 or later
• Implement compensating controls such as monitoring and exception tracking
• Verify affected scope and inventory checks
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by an integer overflow in the websock_decode() function. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.