The flaw resides in the clear_storages routine in lily_emitter.c of the FascinatedBox Lily project up to version 2.3. An attacker with local access can manipulate the function to trigger an out‐of‐bounds read, allowing arbitrary memory contents to be inspected. The vulnerability is classified as CWE‑119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE‑125 (Out-of-bounds Read). The potential impact is leakage of sensitive data from memory, which can aid further attacks such as credential theft or system compromise.

The issue affects all installations of FascinatedBox Lily versions 2.3 and earlier. No later sub‑versions are listed as patched, and the repository has no public fix mentioned in the current release data.

The CVSS v3.1 score is 4.8, indicating a medium risk when considering local access. The EPSS score is less than 1%, suggesting that exploitation likelihood is low at present, although a public exploit has already been made available. The vulnerability is not yet listed in the CISA KEV catalog, which implies no large‑scale exploitation has been reported. The likely attack vector is local, requiring that an adversary already runs code on the host or gains local file access to deploy the exploit.