CVE-2026-29078: 
PHP vulnerability analysis and mitigation

CVE-2026-29078 is an integer underflow vulnerability in the ISO-2022-JP encoder of Lexbor, a web browser engine library, that leads to out-of-bounds memory access. All Lexbor versions prior to 2.7.0 are affected (specifically confirmed in version 2.6.0). The vulnerability was discovered by Nikita Sveshnikov of Positive Technologies and disclosed on March 13, 2026, with a fix released in version 2.7.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an integer underflow (CWE-191) combined with an out-of-bounds write (CWE-787) in Lexbor's ISO-2022-JP character encoding logic. The encoder fails to reset a temporary size variable between loop iterations; when ctx->buffer_used -= size is executed with a stale size value of 3, the result wraps around to SIZE_MAX (the maximum value of a size_t). A subsequent memcpy call using this wrapped value as the length triggers an out-of-bounds read from the stack and an out-of-bounds write to the heap. The source data fed into this code path is partially controllable by an attacker through the contents of the DOM tree processed by the library, enabling network-based exploitation with no privileges or user interaction required (GitHub Advisory).

Successful exploitation can cause denial of service through application crashes or undefined behavior resulting from heap memory corruption. There is also potential for limited information disclosure via out-of-bounds stack reads, which may expose sensitive in-memory data depending on the application context. The vulnerability is network-accessible with no authentication or user interaction required, making it exploitable against any service that uses Lexbor to parse or encode DOM content submitted by remote users (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a network-accessible application or service that uses Lexbor (versions prior to 2.7.0) to parse or process HTML/DOM content, such as a web scraper, HTML sanitizer, or browser engine component.
2. Craft malicious DOM content: Construct HTML input containing characters that trigger the ISO-2022-JP encoding path within Lexbor's encoder, specifically content that causes the encoder to iterate and leave the size variable in a stale state.
3. Submit crafted input: Deliver the malicious HTML/DOM content to the target application via its normal input channel (e.g., HTTP request body, URL parameter, or file upload), causing Lexbor to process the content.
4. Trigger integer underflow: The stale size = 3 value causes ctx->buffer_used -= size to underflow, wrapping to SIZE_MAX.
5. Achieve memory corruption: The subsequent memcpy call with the wrapped length performs an out-of-bounds read from the stack and an out-of-bounds write to the heap, potentially crashing the application (DoS) or leaking stack memory contents (GitHub Advisory).

• Logs: Unexpected application crashes or segmentation faults in services using Lexbor; crash dump files generated by the Lexbor-dependent process.
• Process: Abnormal termination of web parsing or HTML processing services; core dumps referencing memory addresses near SIZE_MAX or heap corruption errors.
• Network: Repeated submissions of HTML content containing ISO-2022-JP encoded characters or escape sequences (ESC ( B, ESC $ B) to endpoints that process DOM content via Lexbor.

The primary remediation is to upgrade Lexbor to version 2.7.0 or later, which resets the size variable correctly between encoder iterations. No official configuration-based workaround has been published. As an interim measure, operators should implement input validation to restrict or sanitize ISO-2022-JP encoded content submitted to applications using Lexbor, and monitor for application crashes indicative of memory corruption. PHP and other projects embedding Lexbor (e.g., via php-src) should also apply their respective upstream patches (GitHub Advisory, Red Hat CVE).

The vulnerability was discovered by Nikita Sveshnikov of Positive Technologies and responsibly disclosed through GitHub's security advisory process. Downstream projects embedding Lexbor, including PHP, have issued patches referencing this CVE, with Fedora package updates noted in Linux community channels. Detection plugins have been published by Tenable (Nessus) and Qualys, indicating scanner vendor awareness. No significant social media controversy or broad media coverage has been observed beyond standard vulnerability tracking feeds.