CVE-2026-3391 in lily
Summary
by MITRE • 03/01/2026
A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/04/2026
The vulnerability identified as CVE-2026-3391 represents a critical out-of-bounds read flaw within the FascinatedBox lily software version 2.3 and earlier. This security weakness resides within the clear_storages function located in the src/lily_emitter.c source file, demonstrating a fundamental failure in input validation and memory management practices. The flaw manifests when the application processes storage clearing operations, where insufficient bounds checking allows malicious actors to access memory locations beyond the intended buffer boundaries. Such vulnerabilities typically arise from inadequate parameter validation and improper memory access controls that fail to account for potential overflow conditions during array or buffer operations.
The exploitation of this vulnerability requires local system access, which significantly limits its attack surface compared to remotely exploitable flaws. However, this local privilege requirement does not diminish the severity of the issue, as local attackers with legitimate system access can leverage this weakness to potentially read sensitive data from memory, execute arbitrary code, or cause system instability. The fact that a public exploit has been released indicates that security researchers and malicious actors have already developed working demonstrations of this vulnerability, increasing the likelihood of real-world exploitation. The vulnerability's classification aligns with CWE-129, which addresses improper validation of array indices, and CWE-125, which covers out-of-bounds read conditions. These weaknesses directly map to the ATT&CK technique T1059.007 for command and scripting interpreter, as attackers could potentially use such memory access flaws to execute malicious code or escalate privileges within the local environment.
The operational impact of this vulnerability extends beyond simple data exposure, as it represents a potential gateway for more sophisticated attacks within the system. Local attackers could exploit this flaw to access confidential information stored in memory, potentially including authentication credentials, application secrets, or other sensitive data that might be cached in the application's memory space. The lack of response from the project maintainers despite early notification through issue reports creates additional security concerns, as the vulnerability remains unpatched and actively exploitable. Organizations using FascinatedBox lily software should immediately implement mitigations such as restricting local access privileges, monitoring for suspicious memory access patterns, and applying temporary workarounds while waiting for official patches. The vulnerability demonstrates poor software development practices regarding memory safety and input validation, highlighting the critical importance of proper code review processes and adherence to secure coding standards to prevent such issues from reaching production environments.