CVE-2026-116740 in libcss
Summary
by MITRE • 10/27/2026
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The libcss library, specifically versions up through 0.9.2, contains a critical NULL pointer dereference vulnerability located within the mq_parse_media_query function. This flaw arises from an insufficient validation of input data during the parsing process for CSS media queries. The specific trigger condition involves the presence of a trailing comma in media lists associated with media or import rules. When a stylesheet containing such malformed syntax is processed, the parser fails to handle this edge case correctly, leading directly to a memory access violation that results in an application crash.
From a technical perspective, the vulnerability stems from improper boundary checking and error handling within the parsing logic. The mq_parse_media_query function likely attempts to dereference a pointer representing the next media query component without verifying if it is NULL after encountering the trailing comma. In standard CSS syntax, a trailing comma often indicates an incomplete or malformed rule set. A robust parser should either reject such input gracefully with a clear error message or ignore the invalid segment while continuing processing of valid rules. Instead, libcss proceeds to access memory at an undefined location, causing immediate termination of the consuming application. This behavior classifies as CWE-476: NULL Pointer Dereference, which is a common software defect that can lead to denial-of-service conditions when exploited remotely or locally by untrusted input sources.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity in its basic form. Attackers who control the content served to users running applications linked against libcss can cause these applications to crash unexpectedly. This includes web browsers like NetSurf, which rely heavily on CSS parsing for rendering pages correctly. If a malicious website serves a stylesheet with a trailing comma in an @media query block, it can trigger this crash upon page load or style recalculation. For end-users, this manifests as application instability and potential loss of unsaved work if the browser crashes during active sessions. While the immediate effect is a denial-of-service via application termination, such instabilities can sometimes be precursors to more severe exploitation vectors depending on how the surrounding memory management handles subsequent operations after the crash point in different implementations or patched versions.
This vulnerability aligns with ATT&CK technique T1499: Endpoint Denial of Service, where attackers disrupt availability by exhausting resources or causing crashes through malformed inputs. It also relates to CWE-20: Improper Input Validation, as the parser does not adequately sanitize or validate the structure of incoming CSS media queries before processing them further down the execution path. The lack of defensive programming practices in handling edge cases like trailing delimiters highlights a gap in the library's resilience against malformed style sheets commonly found on the open web.
Mitigation strategies for this vulnerability involve immediate updates to affected software components. Users and developers relying on libcss should upgrade to version 0.9.3 or later, where this specific NULL pointer dereference has been addressed through improved input validation logic within mq_parse_media_query. For applications that cannot immediately update their dependencies, implementing a pre-processing step to sanitize incoming CSS stylesheets by removing trailing commas in media query lists can serve as a temporary workaround. Additionally, developers should ensure that any custom wrappers around libcss include robust error handling mechanisms to catch parsing exceptions and prevent crashes from propagating to the main application thread. Regular security audits of third-party library usage are recommended to identify similar input validation gaps across other components of the software stack.