CVE-2026-2258

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2258

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2258.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2258

Published

2026-02-10T00:16:06.523Z

Modified

2026-02-12T07:36:44.534619Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

[none]

Details

A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been published and may be used. This patch is called c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd. It is advisable to implement a patch to correct this issue.

References

Affected packages

Git / github.com/aardappel/lobster

Affected ranges

Type: GIT
Repo: https://github.com/aardappel/lobster
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd

Affected versions

Other

before_namespace_change

last_coroutine

last_dynamically_typed

last_frame_log

last_interpreter

last_wasm_generator_enabled

lastruntimerefc

v2021.*

v2021.0

v2021.1

v2021.3

v2023.*

v2023.10

v2023.12

v2023.13

v2023.2

v2023.4

v2023.5

v2023.6

v2023.7

v2023.8

v2023.9

v2024.*

v2024.0

v2025.*

v2025.0

v2025.1

v2025.2

v2025.3

v2025.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2258.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149441422473073204035151101208355948211",
            "length": 64673.0
        },
        "signature_type": "Function",
        "target": {
            "file": "dev/src/builtins.cpp",
            "function": "AddBuiltins"
        },
        "source": "https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd",
        "id": "CVE-2026-2258-4971879b",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "100809937407497191186467615693694384644",
                "291672030347935644924875984726065947874",
                "209624420738958640797477219256583237232",
                "200589747735385998485470761200022030492"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "dev/src/builtins.cpp"
        },
        "source": "https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd",
        "id": "CVE-2026-2258-4d8ef37d",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "187687960168184486130549144266623565902",
            "length": 4834.0
        },
        "signature_type": "Function",
        "target": {
            "file": "dev/src/lobster/wfc.h",
            "function": "WaveFunctionCollapse"
        },
        "source": "https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd",
        "id": "CVE-2026-2258-8a29a2ac",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "294748604808263208798518096772262028547",
                "206216704175555706470897118579159555709",
                "258898092569387250306963829916173409221",
                "15379035110231477586917698930954470167",
                "126179339088445396706538042837622491258"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "dev/src/lobster/wfc.h"
        },
        "source": "https://github.com/aardappel/lobster/commit/c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd",
        "id": "CVE-2026-2258-cb9ab7bd",
        "signature_version": "v1"
    }
]