Integer Underflow in Lexbor ISO‑2022‑JP Encoder
概要
Integer Underflow in Lexbor ISO‑2022‑JP Encoder
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-29078 lexbor 修正版: 3.0.0-1
- Ubuntu UBUNTU-CVE-2026-29078 lexbor
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov