An out-of-bounds write vulnerability in libwebsockets version 4.5.0 introduces a risk of memory corruption, potentially allowing remote attackers to crash the service or execute code.

The vulnerability is an out-of-bounds write (CWE-787) occurring during the parsing process, specifically within the lecp module. This memory corruption flaw is reachable by an unauthenticated attacker.

Memory corruption vulnerabilities often lead to service instability, denial of service, or potentially arbitrary code execution. Given the CVSS score of 7.3, this issue represents a significant threat to services relying on libwebsockets for network communication, potentially impacting both system availability and security.

Immediate Action: Update to the patched version of libwebsockets as identified in the project's commit history (commit 1d44554a1bb262db63ff4e240152a9deecd99054).

Proactive Monitoring: Monitor for unexpected service crashes or restarts that may indicate successful exploitation of memory corruption flaws.

Compensating Controls: Ensure that the application is running with memory protection features enabled, such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

The presence of a public proof-of-concept necessitates immediate action. Developers and system administrators should pull the latest version of libwebsockets or apply the specific fix commit provided by the vendor to remediate this memory corruption risk.