CVE-2026-3391 - FascinatedBox lily lily_emitter.c clear_storages out-of-bounds

Back Back to CVE browser

MEDIUM

FascinatedBox lily lily_emitter.c clear_storages out-of-bounds

Published Mar 1, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor FascinatedBox Product Lily Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FascinatedBox

Lily

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.2	affected	-
2.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (6)

https://github.com/FascinatedBox/lily/
product
https://github.com/FascinatedBox/lily/issues/383
issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/oneafter/0122/blob/main/i383/repro.lily
exploit
https://vuldb.com/?ctiid.348277
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.348277
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.761327
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/FascinatedBox/lily/		product
https://github.com/FascinatedBox/lily/issues/383		issue-trackingExploitIssue TrackingVendor Advisory
https://github.com/oneafter/0122/blob/main/i383/repro.lily		exploit
https://vuldb.com/?ctiid.348277		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.348277		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.761327		third-party-advisoryThird Party AdvisoryVDB Entry