PT-2026-25331 · Debian+3 · Lexbor

Nikita Sveshnikov · CVE-2026-29079 · Publicado 2026-01-01 · Atualizado 2026-03-13

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lexbor versions prior to 2.7.0

Description Lexbor is a web browser engine library. A type-confusion issue exists in Lexbor’s HTML fragment parser. When ns is UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified name field. This corrupted value is later used as a pointer and dereferenced.

Recommendations Update to Lexbor version 2.7.0 or later.

Exploit

Correção

Type Confusion

Enumeração de Fraquezas

CWE-843

Identificadores relacionados

CVE-2026-29079

GHSA-MRPR-V36Q-2VP8

Produtos afetados

Lexbor

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29079.json · Exploit
• https://github.com/lexbor/lexbor/security/advisories/GHSA-mrpr-v36q-2vp8 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29079 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-29079 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-29079 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-29079 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-29079 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-29079 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032605922615300517 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29079 · Aviso do Fabricante