A flaw in the patch_line_end routine of the Error Reporting component in FascinatedBox lily allows an out‑of‑bounds read. The bug is triggered by manipulating the input supplied to this routine from a local environment. The reading of memory beyond the intended buffer can leak data that is only intended for internal processing or lead to an application crash, impacting confidentiality and integrity for a local attacker. The weakness corresponds to CWE‑119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE‑125 (Out‑of‑Bounds Read).

This issue affects the FascinatedBox lily language up to version 2.3. In particular, any installation running lily 2.3 or earlier is vulnerable. No specific patch version is listed, so users should verify whether a newer release addresses the bug before updating.

The CVSS score of 4.8 indicates moderate severity. EPSS is less than 1 %, signifying a very low but non‑zero probability of exploitation. Because the attack vector is local only and no known public exploits have been recorded in the CISA KEV catalog, the risk is primarily to systems that allow local code execution or user input into lily. The exploit is available in public repositories, so the potential exists for those with local access to deploy it. Overall, the risk remains moderate but can be mitigated by restricting local access or updating the software.