Read the docs
TI-2026-01906 Aliases CVE-2026-2259GHSA-xfpq-772f-h5qw

aardappel lobster Parsing parser.h ParseStatements memory corruption

Priority LOW 22CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2f45fe860d00990e79e13250251c1dde633f1f89. Applying a patch is the recommended action to fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aardappellobster2025.0; 2025.1; 2025.2; 2025.3; 2025.4—No fix listedCNA
  • lobster Vendoraardappel Affected 2025.0; 2025.1; 2025.2; 2025.3; 2025.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:*up to 2025.4Vulnerableaardappel
  • cpe:2.3:a:strlen:lobster:*:*:*:*:*:*:*:* Versions up to 2025.4 Vulnerable ·aardappel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2259
  2. 2026-10-03 Alias added: GHSA-xfpq-772f-h5qw

References

Exploit 1

Patch 3

Other 1

  • TI-2026-02481 aardappel lobster idents.h TypeName recursion CVSS 4.0MEDIUM 4.8
  • TI-2026-01905 aardappel lobster wfc.h WaveFunctionCollapse memory corruption CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences