CVE-2026-29079: Lexbor Use-After-Free Vulnerability

CVE-2026-29079 Overview

CVE-2026-29079 is a type confusion vulnerability in Lexbor, a web browser engine library. Prior to version 2.7.0, a critical flaw exists in Lexbor's HTML fragment parser that allows attackers to corrupt memory through unsafe type casting. When the namespace is set to UNDEF, a comment is created using the "unknown element" constructor. The comment's data are then written into the element's fields via an unsafe cast, corrupting the qualified_name field. This corrupted value is subsequently used as a pointer and dereferenced near the zero page, leading to potential denial of service conditions.

Critical Impact

Network-accessible type confusion vulnerability in Lexbor's HTML parser that corrupts memory and leads to null pointer dereference, potentially crashing applications that rely on Lexbor for HTML processing.

Affected Products

• Lexbor versions prior to 2.7.0
• Applications and libraries built on top of Lexbor HTML parsing engine
• Web browsers and content processing systems using Lexbor as their rendering engine

Discovery Timeline

• 2026-03-13 - CVE-2026-29079 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-29079

Vulnerability Analysis

This vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type, commonly known as Type Confusion). The flaw resides in the HTML fragment parsing logic within Lexbor's core parsing engine.

The vulnerability occurs during the processing of HTML fragments when the namespace (ns) is undefined. Under these conditions, the parser incorrectly creates a comment node using the constructor designed for "unknown elements." Because comments and unknown elements have different memory layouts and field structures, when comment data is written to the element's fields, it overwrites memory in unexpected ways.

Specifically, the qualified_name field—which should contain a valid pointer to the element's qualified name string—becomes corrupted with data from the comment. When this corrupted pointer value is later dereferenced during subsequent parsing operations, it attempts to access memory near the zero page (addresses close to 0x0), resulting in a crash.

Root Cause

The root cause is an unsafe type cast in Lexbor's HTML fragment parser. The parser fails to properly validate the type of node being created before writing data to type-specific fields. When a comment is created via the unknown element constructor path, the code assumes the memory layout matches an element structure rather than a comment structure. This architectural assumption leads to memory corruption when the namespace is undefined, as the wrong constructor is invoked for comment creation.

Attack Vector

The attack can be triggered remotely over the network by providing maliciously crafted HTML content to an application using Lexbor for HTML parsing. An attacker can craft HTML fragments with specific namespace configurations that trigger the vulnerable code path. When the parser encounters these malformed fragments:

1. The namespace is set to UNDEF during fragment parsing
2. The parser incorrectly routes comment creation through the unknown element constructor
3. Comment data overwrites the qualified_name field
4. The corrupted pointer is dereferenced, causing a crash near the zero page

This vulnerability does not require user interaction or special privileges to exploit, making it accessible to remote attackers who can supply HTML content to vulnerable applications.

Detection Methods for CVE-2026-29079

Indicators of Compromise

• Application crashes with segmentation faults near null pointer addresses (zero page)
• Unexpected termination of processes utilizing Lexbor HTML parsing functionality
• Error logs showing memory access violations during HTML fragment processing
• Core dumps indicating crashes in Lexbor parsing functions related to namespace handling

Detection Strategies

• Monitor application logs for crashes occurring during HTML parsing operations
• Implement runtime memory sanitizers (AddressSanitizer, MemorySanitizer) in development and staging environments to detect type confusion issues
• Deploy application-level exception monitoring to track crashes in Lexbor-dependent code paths
• Use static analysis tools to identify Lexbor library versions in your software inventory

Monitoring Recommendations

• Enable crash reporting and analysis for applications using Lexbor to identify potential exploitation attempts
• Implement software composition analysis (SCA) scanning to identify vulnerable Lexbor versions across your environment
• Monitor network traffic for unusually malformed HTML payloads targeting HTML parsing endpoints
• Set up alerts for repeated application crashes that may indicate active exploitation attempts

How to Mitigate CVE-2026-29079

Immediate Actions Required

• Upgrade Lexbor to version 2.7.0 or later immediately
• Audit all applications and dependencies for Lexbor usage and update accordingly
• If immediate upgrade is not possible, implement input validation and sanitization for HTML content before parsing
• Consider deploying web application firewalls (WAF) with rules to filter potentially malicious HTML fragments

Patch Information

The vulnerability has been addressed in Lexbor version 2.7.0. The fix properly handles the type distinction between comment nodes and element nodes during HTML fragment parsing, ensuring that comments are created using the appropriate constructor regardless of namespace state. Security details and the official advisory are available at the GitHub Security Advisory.

Workarounds

• Implement strict input validation on HTML content before passing to Lexbor parser
• Deploy process isolation or sandboxing for applications performing HTML parsing to limit crash impact
• Use alternative HTML parsing libraries temporarily if upgrading Lexbor is not immediately feasible
• Apply resource limits and restart policies to mitigate denial of service impact from crashes

# Update Lexbor to patched version
# Using package manager (example)
apt-get update && apt-get install lexbor>=2.7.0

# Or rebuild from source with patched version
git clone https://github.com/lexbor/lexbor.git
cd lexbor
git checkout v2.7.0
cmake -DCMAKE_BUILD_TYPE=Release .
make && make install