CVE-2026-29078

Integer Underflow in Lexbor ISO‑2022‑JP Encoder

State: Published
Severity: 8.2 High
Published: Mar 13, 2026
Updated: Mar 16, 2026
Reserved: Mar 3, 2026

Description

Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-191 Integer Underflow (Wrap or Wraparound)
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
lexborlexbor	< 2.7.0Affected

References

https://github.com/lexbor/lexbor/security/advisories/GHSA-mrwr-xh7f-96v3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.