Log in Start free

Vulnerability · Published Mar 13, 2026 · Assigned by GitHub_M

CVE-2026-29078Integer Underflow in Lexbor ISO‑2022‑JP Encoder

High 8.2

In plain English

A high-severity out-of-bounds write in lexbor from lexbor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.3%top 79.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.22php848.4.27-r0ALPINE-CVE-2026-29078
Alpine:v3.23php848.4.21-r0ALPINE-CVE-2026-29078
Alpine:v3.23php858.5.6-r0ALPINE-CVE-2026-29078
Alpine:v3.24php858.5.6-r0ALPINE-CVE-2026-29078
Debian:14lexbor3.0.0-1DEBIAN-CVE-2026-29078
Ubuntu:26.04:LTSlexborno fix listedUBUNTU-CVE-2026-29078
Ubuntu:26.10lexborno fix listedUBUNTU-CVE-2026-29078

Affected products (as reported)

VendorProductVersions
lexbor lexbor < 2.7.0

Weakness: CWE-191, CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References