PT-2026-25330 · Debian+3 · Lexbor

Nikita Sveshnikov · Published 2026-01-01 · Updated 2026-03-13 · CVE-2026-29078

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lexbor versions prior to 2.7.0

Description Lexbor is a web browser engine library. Before version 2.7.0, the ISO‑2022‑JP encoder in Lexbor does not reset the temporary size variable between iterations. The statement ctx->buffer used -= size with an outdated size of 3 causes an integer underflow that wraps to SIZE MAX. Subsequently, memcpy is called with a negative length, resulting in an out-of-bounds read from the stack and an out-of-bounds write to the heap. The source data is partially controllable through the contents of the DOM tree.

Recommendations Versions prior to 2.7.0 should be updated to version 2.7.0 or later.

Exploit

Fix

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-191

CWE-787

Related Identifiers

CVE-2026-29078

GHSA-MRWR-XH7F-96V3

Affected Products

Lexbor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29078.json · Exploit
• https://github.com/lexbor/lexbor/security/advisories/GHSA-mrwr-xh7f-96v3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29078 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29078 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29078 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-29078 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-29078 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29078 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2032606854816092285 · Twitter Post
• https://twitter.com/CVEnew/status/2032605923718377950 · Twitter Post