An integer underflow occurs in the ISO‑2022‑JP encoder of Lexbor when the temporary size variable is not reset between iterations. This causes the subtraction ctx->buffer_used \-\= size to wrap to SIZE_MAX. Subsequent memcpy is called with a negative (underflowed) length, resulting in an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data for the bug is partially controllable via the DOM tree, so an attacker can influence the data that triggers the encoder. The resulting memory corruption could lead to disclosure of sensitive information or execution of arbitrary code in the context where Lexbor runs.

Lexbor web browser engine library (cpe:2.3:a:lexbor:lexbor). All releases prior to version 2.7.0 are affected. No further version details are provided.

The CVSS score of 8.2 indicates high severity. EPSS is reported as less than 1%, implying a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through crafted DOM content that activates the ISO‑2022‑JP encoder; this inference is based on the description that the source data is controllable via the DOM.