CVE-2026-2258: 
NixOS vulnerability analysis and mitigation

CVE-2026-2258 is a memory corruption vulnerability in the WaveFunctionCollapse function of the aardappel Lobster programming language, located in dev/src/lobster/wfc.h. It affects all versions of Lobster up to and including 2025.4. The flaw was reported on February 4, 2026, and publicly disclosed on February 10, 2026, with a patch committed shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, GitHub Issue).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write). Specifically, the WaveFunctionCollapse template function in wfc.h does not validate that input tile characters fall within the required 0–127 range before using them as array indices, allowing negative char values to be used as indices into a fixed-size lookup array. This was confirmed via AddressSanitizer (ASan) as a stack-use-after-return read at wfc.h:52:17, where the program reads from a stack address belonging to a function frame that has already returned. Exploitation requires local access and the ability to supply a crafted tilemap input to the wave_function_collapse built-in function (GitHub Issue, GitHub Commit).

Successful exploitation causes memory corruption leading to a denial of service (application crash/abort) on the affected system. There is no evidence of confidentiality or integrity impact — the vulnerability's primary consequence is availability loss, as the Lobster runtime aborts upon triggering the out-of-bounds memory access. The attack is limited to local scope and does not facilitate lateral movement or data exfiltration (Feedly).

A proof-of-concept exploit has been publicly disclosed and is available on VulDB (VulDB). The PoC consists of a crafted Lobster script (repro.lobster) that passes a tilemap containing characters outside the 0–127 range to the wave_function_collapse built-in, triggering the crash (GitHub PoC). There is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.015% (0.000150), indicating very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Obtain a vulnerable Lobster binary: Acquire or build the Lobster interpreter (version ≤ 2025.4) from the aardappel/lobster repository.
2. Craft a malicious tilemap: Create a Lobster script that passes a tilemap string containing at least one character with a value outside the 0–127 range (i.e., a negative char value, such as an extended ASCII or raw byte > 127) to the wave_function_collapse built-in function.
3. Execute the script: Run the crafted script with the vulnerable Lobster binary: ./bin/lobster repro.lobster.
4. Trigger memory corruption: The WaveFunctionCollapse function reads the out-of-range character as an array index without bounds checking, causing a stack-use-after-return memory access and resulting in an application crash (denial of service) (GitHub Issue, GitHub PoC).

• Process: Lobster interpreter process (lobster) terminating abnormally with an ABORTING message or segmentation fault when processing tilemap inputs.
• Logs: AddressSanitizer output containing ERROR: AddressSanitizer: stack-use-after-return referencing wfc.h:52 in the process stderr or crash logs.
• File System: Presence of unexpected .lobster script files containing tilemap strings with non-ASCII or high-byte characters passed to wave_function_collapse.
• Process: Core dump files generated by the Lobster process in the working directory following a crash (GitHub Issue).

The maintainer has released a fix in commit c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd, which adds a bounds check (if (t < 0) return false;) in wfc.h before using the tile character as an array index, and updates the error message in builtins.cpp accordingly. Users should update to any Lobster release that includes this commit (post-2025.4). No configuration-based workaround is available; upgrading to a patched version is the only remediation (GitHub Commit).