CVE-2026-29078 Integer Underflow in Lexbor ISO‑2022‑JP Encoder
An integer underflow in the Lexbor ISO-2022-JP encoder allows out-of-bounds memory access, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29078?
CVE-2026-29078 is a high-severity vulnerability in lexbor, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
Which versions are affected by CVE-2026-29078?
It affects 1 product.
Products include Lexbor Lexbor.
How do I fix CVE-2026-29078?
Upgrade to a fixed version.
Is CVE-2026-29078 being exploited?
There is no known exploitation of CVE-2026-29078 in the wild and no public exploit code.
Other vulnerabilities in lexbor
Sources
Also known as DEBIAN-CVE-2026-29078, GHSA-mrwr-xh7f-96v3, UBUNTU-CVE-2026-29078.