Description
A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2f45fe860d00990e79e13250251c1dde633f1f89. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aardappel | lobster | 2025.0, 2025.1, 2025.2, 2025.3, 2025.4 | — |
References
- VDB-345006 | aardappel lobster Parsing parser.h ParseStatements memory corruption vdb-entry technical-description
- VDB-345006 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #753168 | aardappel lobster 8ba49f9 Memory Corruption third-party-advisory
- https://github.com/aardappel/lobster/issues/396 issue-tracking
- https://github.com/aardappel/lobster/issues/396#issuecomment-3849019040 issue-tracking
- https://github.com/oneafter/0204/blob/main/lob2/repro.lobster exploit
- https://github.com/aardappel/lobster/commit/2f45fe860d00990e79e13250251c1dde633f1f89 patch
- https://github.com/aardappel/lobster/ product