The vulnerability is a type‑confusion bug in Lexbor’s HTML fragment parser. When the namespace (ns) value is UNDEF, the parser creates a comment element via the “unknown element” constructor. An unsafe cast writes the comment data into the element’s fields, corrupting the qualified_name field. The corrupted value is later dereferenced as a pointer near the zero page, resulting in a memory corruption that can lead to a crash or potentially allow execution of arbitrary code. This weakness is identified by CWE‑843.

The flaw exists in all Lexbor releases prior to 2.7.0. Vendor product: lexbor:lexbor identified by the CPE cpe:2.3:a:lexbor:lexbor:*:*:*:*:*:*:*:. The affected versions are any version before 2.7.0; no narrower range is supplied.

The CVSS score of 8.2 indicates a high impact, while the EPSS score of less than 1% suggests the vulnerability is currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to supply specially crafted HTML fragments that trigger the parser; thus, it may be exploitable in both remote contexts (e.g., web applications using Lexbor) and local contexts (e.g., client‑side rendering) depending on how the library is integrated. Because the defect corrupts memory, it can quickly lead to a denial‑of‑service or, if the corruption is leveraged, to remote code execution.