Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-29078 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Lexbor Lexbor. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-29078 is an integer underflow vulnerability (CWE-191) in the ISO-2022-JP encoder of Lexbor, an open-source web browser engine library. In versions prior to 2.7.0, the encoder fails to reset a temporary size variable between iterations, resulting in the statement ctx->buffer_used -= size using a stale size value of 3. This causes an underflow that wraps to SIZE_MAX, leading to a memcpy call with a negative length and subsequent out-of-bounds read from the stack and out-of-bounds write to the heap (CWE-787). The source data is partially controllable through the contents of the DOM tree.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low complexity, no privileges or user interaction required. Remote attackers can trigger the issue by supplying malicious input processed by the encoder, potentially causing memory corruption that results in denial-of-service through application crashes.
The vulnerability is fixed in Lexbor version 2.7.0. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub Security Advisory at https://github.com/lexbor/lexbor/security/advisories/GHSA-mrwr-xh7f-96v3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12051
Vulnerability Data
Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that…
more
wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static/dynamic analysis directly find integer underflow defects before code is released.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Security engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer underflow during subtraction.
Input validation can reject or sanitize values that would cause a subtraction to underflow the representable range.
Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent integer underflow defects via input validation, bounds checking, and static analysis.
Vulnerability scanning and code analysis can surface underflow flaws after they are introduced.
Routine patching can remediate known underflow bugs once they are discovered in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches integer underflow defects before release.
Secure development lifecycle mandates input validation and arithmetic checks that prevent integer underflow.
Application security requirements include bounds checking and safe arithmetic to avoid underflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards directly prescribe safe integer handling and overflow/underflow prevention.
Change management can enforce review gates that catch unsafe memory operations before deployment.