The vulnerability resides in the count_transforms function within lily_emitter.c of FascinatedBox lily. The function performs an out-of-bounds read when processing certain input, allowing a local attacker to read memory that should not be accessible. This flaw corresponds to unchecked memory access weaknesses (CWE‑119, CWE‑125, CWE‑787) and could potentially expose sensitive data from the process memory.

Affected systems are installations of FascinatedBox lily up to and including version 2.3. The project is hosted on GitHub, with the source code in the lily repository. Users who are running the 2.3 or earlier releases are potentially impacted.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog and can only be exploited locally, meaning an attacker would need local or elevated access to the target machine. In absence of a vendor patch, the risk remains limited but not negligible for environments where local users are untrusted.