Vulnerability details
CVE-2026-29078
lexbor lexbor
Integer Underflow in Lexbor ISO‑2022‑JP Encoder
CVSS 4.0
8.2High
Official description
Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| lexbor | lexbor | < 2.7.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/lexbor/lexbor/security/advisories/GHSA-mrwr-xh7f-96v3 x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-13
- Last updated
- 2026-03-16
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.3%
Probability of exploitation in 30 days
23.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-191Integer Underflow (Wrap or Wraparound)
- CWE-787Out-of-bounds Write