VDB
CVE-2026-3392
CVE-2026-3392
PUBLISHED
CVSS 4.800000190734863 MEDIUM
A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
EPSS 0.19% · 8.8th percentile
Risk Scores
CVSS 4.0
4.800000190734863
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS Score
0.19%
8.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| FascinatedBox | lily | 2.0, 2.1, 2.3 |
| lily-lang | lily | 0 |
Timeline
- Feb 28, 2026 CVE ID Reserved
- Mar 1, 2026 EPSS Score
- Mar 1, 2026 CVE Published
- Mar 1, 2026 PoC Published
- Mar 2, 2026 CVE Updated
- Mar 3, 2026 EPSS Score
- Mar 5, 2026 EPSS Score
- Mar 7, 2026 EPSS Score
- Mar 8, 2026 EPSS Score
- Mar 10, 2026 EPSS Score
- Mar 12, 2026 EPSS Score
- Mar 14, 2026 EPSS Score
References
- VDB-348278 | FascinatedBox lily lily_emitter.c eval_tree null pointer dereference vdb
- Submit #761328 | FascinatedBox lily main-branch NULL Pointer Dereference third-party-advisory
- https://github.com/FascinatedBox/lily url
- https://github.com/oneafter/0122/blob/main/i384/repro.lily url
- VDB-348278 | CTI Indicators (IOB, IOC, IOA) url
- https://github.com/FascinatedBox/lily/ url
- https://nvd.nist.gov/vuln/detail/CVE-2026-3392 advisory
- https://github.com/FascinatedBox/lily/issues/384 discussion