A flaw in the lobster::Parser::ParseStatements function of aardappel Lobster’s parser component can corrupt memory by handling input size incorrectly. The misuse of a size parameter can overwrite adjacent data structures, leading to undefined behavior within the parser’s process. The vulnerability is a classic memory corruption issue and may be triggered by malicious or malformed input fed to the parser.

All releases of aardappel Lobster up to and including 2025.4 are affected. The vulnerability is documented in the component dev/src/lobster/parser.h and has been addressed by the commit 2f45fe860d00990e79e13250251c1dde633f1f89. Only versions distributed by the aardappel:lobster vendor before this patch are impacted.

The CVSS score of 4.8 signifies moderate severity, and the EPSS score indicates a very low probability of exploitation (less than 1%). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the system running the parser; there is no known remote attack vector. If successful, the memory corruption could allow an attacker to execute arbitrary code within the context of the local process that owns the parser.