PT-2026-7197 · Wfc.H+1 · Wfc.H+1

Oneafter · Published 2026-02-10 · Updated 2026-02-17 · CVE-2026-2258

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aardappel lobster versions prior to 2025.4

Description A flaw exists in the WaveFunctionCollapse function within the dev/src/lobster/wfc.h library. A manipulation of this function can lead to memory corruption. The attack is limited to local execution. An exploit for this issue has been published.

Recommendations Implement the patch c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd to correct this issue.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

CVE-2026-2258

Affected Products

Aardappel Lobster

Wfc.H

References · 13

• 🔥 https://github.com/oneafter/0204/blob/main/lob1/repro.lobster · Exploit
• 🔥 https://vuldb.com/?submit.753167 · Exploit
• https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd · Patch
• https://github.com/aardappel/lobster/issues/395 · Vendor Advisory
• https://github.com/aardappel/lobster/issues/395#issuecomment-3849012938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2258 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2258 · Vendor Advisory
• https://vuldb.com/?id.345005 · Note
• https://vuldb.com/?ctiid.345005 · Note
• https://twitter.com/CVEnew/status/2021064112088776802 · Twitter Post
• https://github.com/aardappel/lobster · Note
• https://t.me/cveNotify/152205 · Telegram Post
• https://t.me/CVEtracker/44258 · Telegram Post