PT-2026-7208 · Unknown · Aardappel Lobster

Oneafter · Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-2259

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions aardappel lobster versions up to 2025.4

Description A memory corruption issue exists in aardappel lobster. The issue is related to the lobster::Parser::ParseStatements function within the dev/src/lobster/parser.h library of the Parsing component. The issue can be exploited locally. The patch identifier is 2f45fe860d00990e79e13250251c1dde633f1f89.

Recommendations Apply the patch with identifier 2f45fe860d00990e79e13250251c1dde633f1f89.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

CVE-2026-2259

Affected Products

Aardappel Lobster

References · 11

• 🔥 https://github.com/oneafter/0204/blob/main/lob2/repro.lobster · Exploit
• 🔥 https://vuldb.com/?submit.753168 · Exploit
• https://github.com/aardappel/lobster/issues/396 · Vendor Advisory
• https://github.com/aardappel/lobster/issues/396#issuecomment-3849019040 · Vendor Advisory
• https://github.com/aardappel/lobster/commit/2f45fe860d00990e79e13250251c1dde633f1f89 · Patch
• https://osv.dev/vulnerability/CVE-2026-2259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2259 · Security Note
• https://vuldb.com/?ctiid.345006 · Note
• https://t.me/CVEtracker/44260 · Telegram Post
• https://vuldb.com/?id.345006 · Note
• https://github.com/aardappel/lobster · Note