Vulnerability Details CVE-2026-29079
Lexbor is a web browser engine library. Prior to 2.7.0, a type‑confusion vulnerability exists in Lexbor’s HTML fragment parser. When ns = UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified_name field. That corrupted value is later used as a pointer and dereferenced near the zero page. This vulnerability is fixed in 2.7.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 18.7%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-29079
-
cpe:2.3:a:lexbor:lexbor:0.1.0
-
cpe:2.3:a:lexbor:lexbor:0.2.0
-
cpe:2.3:a:lexbor:lexbor:0.4.0
-
cpe:2.3:a:lexbor:lexbor:1.0.0
-
cpe:2.3:a:lexbor:lexbor:2.1.0
-
cpe:2.3:a:lexbor:lexbor:2.2.0
-
cpe:2.3:a:lexbor:lexbor:2.3.0
-
cpe:2.3:a:lexbor:lexbor:2.4.0
-
cpe:2.3:a:lexbor:lexbor:2.5.0
-
cpe:2.3:a:lexbor:lexbor:2.6.0