PT-2026-25331

CVE-2026-29079

Publicado

2026-01-01

Atualizado

2026-03-13

Descrição por

CVSS 4.0

8.2

Alta

MétricasAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lexbor versions prior to 2.7.0

Description Lexbor is a web browser engine library. A type-confusion issue exists in Lexbor’s HTML fragment parser. When ns is UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified name field. This corrupted value is later used as a pointer and dereferenced.

Recommendations Update to Lexbor version 2.7.0 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Nikita Sveshnikov

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

Identificadores relacionados