Description
A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-03-01
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Denial of Service via null pointer dereference
Action: Monitor
AI Analysis

Impact

A null pointer dereference in the eval_tree function of FascinatedBox lily can crash the program when it processes crafted input. This flaw is specifically a local vulnerability, meaning only users who can execute lily code on the affected system can trigger it. The resulting crash would lead to a denial of service, interrupting legitimate use of lily.

Affected Systems

The vulnerability affects all releases of FascinatedBox lily up to and including version 2.3. It is present in the source file src/lily_emitter.c and exists in the public GitHub repository at https://github.com/FascinatedBox/lily/. Users of earlier versions, or third‑party builds that incorporate lily code before a patch, are also exposed.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is reported as less than 1 percent, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires local access, so remote exploitation is not possible unless the attacker can already run lily code on the target. Given the public availability of the exploit code, organizations should consider the risk high enough to prompt prompt remediation.

Generated by OpenCVE AI on April 18, 2026 at 10:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Identify all deployment instances of FascinatedBox lily, note the version, and flag any running release up to 2.3 as vulnerable to the null‑pointer dereference (CWE‑476).
  • If the application is critical, isolate the lily process in a restricted environment or limit local user permissions, ensuring that only trusted code paths with proper null checks (addressing CWE‑476) can run.
  • Keep the project’s GitHub page under watch for any new commits or pull requests that fix the null‑pointer dereference and improve error handling (CWE‑476, CWE‑404), and plan to apply the patch as soon as it becomes available.

Generated by OpenCVE AI on April 18, 2026 at 10:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Mar 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Lily-lang
Lily-lang lily
CPEs cpe:2.3:a:lily-lang:lily:*:*:*:*:*:*:*:*
Vendors & Products Lily-lang
Lily-lang lily

Mon, 02 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Fascinatedbox
Fascinatedbox lily
Vendors & Products Fascinatedbox
Fascinatedbox lily

Sun, 01 Mar 2026 11:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title FascinatedBox lily lily_emitter.c eval_tree null pointer dereference
Weaknesses CWE-404
CWE-476
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fascinatedbox Lily
Lily-lang Lily
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-02T18:20:08.297Z

Reserved: 2026-02-28T17:03:52.364Z

Link: CVE-2026-3392

cve-icon Vulnrichment

Updated: 2026-03-02T18:19:46.422Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-01T12:16:00.753

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-3392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T10:15:25Z

Weaknesses