CVE-2026-3392: falha de média gravidade em FascinatedBox lily
FascinatedBox lily lily_emitter.c eval_tree null pointer dereference
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.2%
A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
FascinatedBox · lilyCVEs relacionadas — FascinatedBox lily
No mesmo produto, das mais perigosas para as menos.
CVE-2026-2662MEDIUMFascinatedBox lily lily_emitter.c count_transforms out-of-boundsEPSS 0.2%CVE-2026-3391MEDIUMFascinatedBox lily lily_emitter.c clear_storages out-of-boundsEPSS 0.2%CVE-2026-2660MEDIUMFascinatedBox lily lily_symtab.c shorthash_for_name use after freeEPSS 0.2%CVE-2026-3390MEDIUMFascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-boundsEPSS 0.2%