DEBIAN-CVE-2026-29078
Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
DEBIAN-CVE-2026-29078
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-29078
lexbor
Source reference: /affected/0/package/name
- Affected versions
- 2.6.0-1
Source reference:
/affected/0/versions2.6.0-2Source reference:
/affected/0/versions3.0.0-1~exp1Source reference:
/affected/0/versions - Fixed versions
- 3.0.0-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-1"
}
]
}
],
"package": {
"name": "lexbor",
"purl": "pkg:deb/debian/lexbor?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.6.0-1",
"2.6.0-2",
"3.0.0-1~exp1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-29078.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56344 · Revision 1
- Added to Heist Feed
- Publisher date