VulnerabilityAnalyzed
CVE-2026-2258
Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h.
LOW 1.9EPSS 0.19%
Does this matter?
Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been published and may be used. This patch is called c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd. It is advisable to implement a patch to correct this issue.
- CVSS 4.0
- 1.9 LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.19% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-787
- Affected
- strlen/lobster
- Source
- cna@vuldb.com
References
- https://github.com/aardappel/lobster/Product
- https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffdPatch
- https://github.com/aardappel/lobster/issues/395Patch, Vendor Advisory
- https://github.com/aardappel/lobster/issues/395#issuecomment-3849012938Patch, Vendor Advisory
- https://github.com/oneafter/0204/blob/main/lob1/repro.lobsterProduct
- https://vuldb.com/?ctiid.345005Permissions Required, VDB Entry
- https://vuldb.com/?id.345005Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.753167Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.