The vulnerability is a NULL pointer dereference in libcss’s mq_parse_media_query function. When an @media or @import rule contains a media list that ends with a trailing comma, the parser dereferences an uninitialized pointer and crashes. An attacker can feed such a stylesheet to a consumer of libcss, causing a crash and a denial‑of‑service.

libcss, used by the Netsurf browser and other consumers, is vulnerable in all releases up to and including 0.9.2. Any application that parses media lists with a trailing comma via this library is affected.

The CVSS score of 7.1 indicates moderate severity for a remote denial‑of‑service. Based on the description, it is inferred that the exploit does not require authentication or special privileges; a remote attacker can trigger a crash simply by delivering the malicious stylesheet. The EPSS score is unavailable, and the vulnerability is not yet listed in the KEV catalog, but the lack of a public exploit means the risk is realistic and should be mitigated.