Vulnerability · Published Feb 10, 2026 · Assigned by VulDB

CVE-2026-2258aardappel lobster wfc.h WaveFunctionCollapse memory corruption

Low 3.3

In plain English

A low-severity memory corruption in lobster from aardappel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been published and may be used. This patch is called c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

Vendor	Product	Versions
aardappel	lobster	2025.02025.12025.22025.32025.4

Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-345005 | aardappel lobster wfc.h WaveFunctionCollapse memory corruption vdb-entry, technical-description
VDB-345005 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #753167 | aardappel lobster 2f45fe8 Return of Stack Variable Address third-party-advisory
https://github.com/aardappel/lobster/issues/395 issue-tracking
https://github.com/aardappel/lobster/issues/395#issuecomment-3849012938 issue-tracking
https://github.com/oneafter/0204/blob/main/lob1/repro.lobster exploit
https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd patch
https://github.com/aardappel/lobster/ product