PT-2026-25331

CVE-2026-29079

Published

2026-01-01

Updated

2026-03-13

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Lexbor versions prior to 2.7.0

Description Lexbor is a web browser engine library. A type-confusion issue exists in Lexbor’s HTML fragment parser. When ns is UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified name field. This corrupted value is later used as a pointer and dereferenced.

Recommendations Update to Lexbor version 2.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nikita Sveshnikov

Vendors

Affected products

Weakness enumeration

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

Related identifiers