TI-2026-02928 Aliases CVE-2026-3392 GHSA-wjxq-hxc4-r33w

FascinatedBox lily lily_emitter.c eval_tree null pointer dereference

MEDIUM 55CWE-404Published 2026-03-01 · Updated 2026-03-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00192 8th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD and the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
FascinatedBox	lily	2.0; 2.1; 2.2; 2.3	—	No fix listed	CNA

lily VendorFascinatedBox Affected 2.0; 2.1; 2.2; 2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lily-lang:lily::::::::	up to 2.3	Vulnerable	FascinatedBox

cpe:2.3:a:lily-lang:lily:*:*:*:*:*:*:*:* Versions up to 2.3 Vulnerable ·FascinatedBox

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-3392
2026-10-03 Alias added: GHSA-wjxq-hxc4-r33w

References

Exploit 2

Other 1

https://github.com/FascinatedBox/lily/

TI-2026-02927 FascinatedBox lily lily_emitter.c clear_storages out-of-bounds CVSS 4.0MEDIUM 4.8
TI-2026-02926 FascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-bounds CVSS 4.0MEDIUM 4.8
TI-2026-02274 FascinatedBox lily lily_emitter.c count_transforms out-of-bounds CVSS 4.0MEDIUM 4.8
TI-2026-02272 FascinatedBox lily lily_symtab.c shorthash_for_name use after free CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences