PT-2026-20486 · Unknown · Fascinatedbox Lily

Oneafter · CVE-2026-2662 · Published 2026-02-18 · Updated 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FascinatedBox lily versions prior to 2.3

Description A flaw exists in FascinatedBox lily, specifically within the count transforms function located in the src/lily emitter.c file. This issue leads to an out-of-bounds read condition. The exploitation of this flaw is limited to local execution. The exploit code has been publicly released. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to 2.3 should be updated. As a temporary workaround, consider restricting access to the src/lily emitter.c file to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-125

CWE-119

Related Identifiers

CVE-2026-2662

Affected Products

Fascinatedbox Lily

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2662.json · Exploit
• 🔥 https://github.com/FascinatedBox/lily/issues/381 · Exploit
• 🔥 https://vuldb.com/?submit.753166 · Exploit
• 🔥 https://github.com/oneafter/0122/blob/main/i381/repro.lily · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2662 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2662 · Vendor Advisory
• https://vuldb.com/?id.346460 · Note
• https://vuldb.com/?ctiid.346460 · Note
• https://t.me/CVEtracker/45012 · Telegram Post
• https://twitter.com/CVEnew/status/2024258091458625573 · Twitter Post
• https://github.com/FascinatedBox/lily · Note