Vulnerability Details CVE-2026-2259
A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2f45fe860d00990e79e13250251c1dde633f1f89. Applying a patch is the recommended action to fix this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 3.5%
CVSS Severity
CVSS v3 Score 3.3
CVSS v2 Score 1.7
References
- https://github.com/aardappel/lobster/
- https://github.com/aardappel/lobster/commit/2f45fe860d00990e79e13250251c1dde633f1f89
- https://github.com/aardappel/lobster/issues/396
- https://github.com/aardappel/lobster/issues/396#issuecomment-3849019040
- https://github.com/oneafter/0204/blob/main/lob2/repro.lobster
- https://vuldb.com/?ctiid.345006
- https://vuldb.com/?id.345006
- https://vuldb.com/?submit.753168
Products affected by CVE-2026-2259
-
cpe:2.3:a:strlen:lobster:2021.0
-
cpe:2.3:a:strlen:lobster:2021.1
-
cpe:2.3:a:strlen:lobster:2021.3
-
cpe:2.3:a:strlen:lobster:2023.10
-
cpe:2.3:a:strlen:lobster:2023.11
-
cpe:2.3:a:strlen:lobster:2023.12
-
cpe:2.3:a:strlen:lobster:2023.13
-
cpe:2.3:a:strlen:lobster:2023.2
-
cpe:2.3:a:strlen:lobster:2023.4
-
cpe:2.3:a:strlen:lobster:2023.5
-
cpe:2.3:a:strlen:lobster:2023.6
-
cpe:2.3:a:strlen:lobster:2023.7
-
cpe:2.3:a:strlen:lobster:2023.8
-
cpe:2.3:a:strlen:lobster:2023.9
-
cpe:2.3:a:strlen:lobster:2024.0
-
cpe:2.3:a:strlen:lobster:2025.0
-
cpe:2.3:a:strlen:lobster:2025.1
-
cpe:2.3:a:strlen:lobster:2025.2
-
cpe:2.3:a:strlen:lobster:2025.3
-
cpe:2.3:a:strlen:lobster:2025.4