PT-2026-22513 · Unknown · Fascinatedbox Lily

Oneafter · Publicado 2026-03-01 · Atualizado 2026-03-01 · CVE-2026-3391

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FascinatedBox lily versions prior to 2.3

Description A security flaw exists in FascinatedBox lily, potentially leading to an out-of-bounds read. The issue resides within the clear storages function located in the src/lily emitter.c file. Exploitation requires local access. The exploit code has been publicly released, increasing the risk of attacks. The project maintainers were notified of the issue but have not yet responded.

Recommendations Update to a version of FascinatedBox lily later than 2.3. As a temporary workaround, consider restricting local access to the affected file src/lily emitter.c until a patch is available.

Exploit

Correção

Buffer Overflow

Out of bounds Read

Enumeração de Fraquezas

CWE-119

CWE-125

Identificadores relacionados

CVE-2026-3391

Produtos afetados

Fascinatedbox Lily

Referências · 12

• 🔥 https://github.com/oneafter/0122/blob/main/i383/repro.lily · Exploit
• https://github.com/FascinatedBox/lily/issues/383 · Aviso do Fabricante
• https://vuldb.com/?id.348277 · Nota
• https://t.me/CVEtracker/46066 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3391 · Aviso do Fabricante
• https://vuldb.com/?ctiid.348277 · Nota
• https://twitter.com/cyberbivash/status/2028203812343656955 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3391 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2028089420834828772 · Publicação no Twitter
• https://vuldb.com/?submit.761327 · Nota
• https://github.com/FascinatedBox/lily · Nota
• https://t.me/cveNotify/153670 · Publicação no Telegram