PT-2026-20486 · Unknown · Fascinatedbox Lily

Oneafter · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2662

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FascinatedBox lily versions prior to 2.3

Description A flaw exists in FascinatedBox lily, specifically within the count transforms function located in the src/lily emitter.c file. This issue leads to an out-of-bounds read condition. The exploitation of this flaw is limited to local execution. The exploit code has been publicly released. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to 2.3 should be updated. As a temporary workaround, consider restricting access to the src/lily emitter.c file to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-787

CWE-119

CWE-125

Related Identifiers

CVE-2026-2662

Affected Products

Fascinatedbox Lily

References · 10

• 🔥 https://github.com/FascinatedBox/lily/issues/381 · Exploit
• 🔥 https://vuldb.com/?submit.753166 · Exploit
• 🔥 https://github.com/oneafter/0122/blob/main/i381/repro.lily · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2662 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2662 · Vendor Advisory
• https://t.me/CVEtracker/45012 · Telegram Post
• https://twitter.com/CVEnew/status/2024258091458625573 · Twitter Post
• https://vuldb.com/?ctiid.346460 · Note
• https://github.com/FascinatedBox/lily · Note
• https://vuldb.com/?id.346460 · Note