CVE-2026-2259: 
NixOS vulnerability analysis and mitigation

CVE-2026-2259 is a memory corruption vulnerability in the Lobster programming language compiler (aardappel/lobster), affecting all versions up to and including 2025.4. The flaw resides in the lobster::Parser::ParseStatements function within dev/src/lobster/parser.h, where certain attribute statements fail to generate a parse tree node, leaving a statement block empty and causing an out-of-bounds read (segmentation fault) when the parser subsequently accesses block->children.back() on an empty container. The vulnerability was reported on February 4, 2026, publicly disclosed on February 10, 2026, and patched shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, GitHub Issue).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write). In ParseStatements, after parsing a block, the code unconditionally accesses block->children.back() at line 118 without first verifying that the children vector is non-empty. When a statement such as attribute is parsed but does not add a node to the block, the vector remains empty, and the subsequent back() call results in undefined behavior — manifesting as a segmentation fault (SEGV) on a READ memory access, as confirmed by AddressSanitizer output. The attack vector is local and requires low privileges; an attacker must be able to supply a crafted .lobster source file to the compiler (GitHub Issue, GitHub Commit).

Successful exploitation causes the Lobster compiler to crash (denial of service) via memory corruption triggered during the parsing phase. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not enable code execution, data exfiltration, or privilege escalation. The affected asset scope is restricted to systems where the Lobster compiler processes untrusted or attacker-supplied source files (Feedly).

A public proof-of-concept reproducer (repro.lobster) is available on GitHub, submitted by the original reporter (PoC File). The vulnerability was also submitted to VulDB (VulDB). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.015% (0.000150), indicating very low probability of exploitation in the near term (Feedly).

1. Obtain the Lobster compiler: Download or build aardappel/lobster version ≤ 2025.4 on a Linux x86_64 system (ideally with a Release build using Clang and ASan enabled for observable crash output).
2. Craft a malicious source file: Create a .lobster file that contains an attribute statement inside a function body or block in a position where it is the only statement, so that ParseStatements processes the block but no parse tree node is added to block->children.
3. Invoke the compiler: Run ./bin/lobster repro.lobster to feed the crafted file to the vulnerable parser.
4. Trigger the crash: The ParseStatements function reaches line 118 and calls block->children.back() on an empty vector, causing an out-of-bounds read and a segmentation fault (SEGV), crashing the compiler process (GitHub Issue, PoC File).

• Process: The lobster compiler process terminates abnormally with a segmentation fault (signal 11/SIGSEGV); crash occurs specifically within lobster::Parser::ParseStatements at parser.h:118.
• Logs/ASan Output: AddressSanitizer reports DEADLYSIGNAL with SEGV on unknown address and a stack trace showing lobster::Parser::ParseStatements → lobster::Parser::ParseBody → lobster::Parser::ParseFunction call chain; summary line: SUMMARY: AddressSanitizer: SEGV /src/lobster/dev/src/lobster/parser.h:118:34.
• File System: Presence of unexpected or externally supplied .lobster source files being passed to the compiler, particularly files containing attribute statements as sole block contents (GitHub Issue).

Apply the fix from commit 2f45fe860d00990e79e13250251c1dde633f1f89 in the aardappel/lobster GitHub repository, which adds an explicit check for empty statement blocks before accessing block->children.back(), raising a compile-time error instead of crashing (GitHub Commit). Users should upgrade to any release beyond version 2025.4 (e.g., v2026.3 or later). As a workaround where upgrading is not immediately possible, restrict local system access and avoid running the Lobster compiler against untrusted or externally supplied source files.