CVE-2026-2660

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthash_for_name of the file src/lily_symtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-416

Affected software

Vendor	Product	Versions
FascinatedBox	lily	2.0; 2.1; 2.2; 2.3

References

https://github.com/FascinatedBox/lily/Product
https://github.com/FascinatedBox/lily/issues/385Exploit, Issue Tracking, Third Party Advisory
https://github.com/oneafter/0122/blob/main/i385/repro.lilyExploit
https://vuldb.com/?ctiid.346458Permissions Required, VDB Entry
https://vuldb.com/?id.346458Third Party Advisory, VDB Entry
https://vuldb.com/?submit.753164Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-26617.8A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.CVE-2026-26627.8A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count_transforms of the file src/lil CVE-2026-26636.3A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /CVE-2026-26647.8An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up CVE-2026-26656.3A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the CVE-2026-26667.2A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the comp CVE-2026-26675.3A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unk CVE-2026-266737.5An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via CVE-2026-26687.3A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of CVE-2026-266827.8An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component CVE-2026-26696.5A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown functi CVE-2026-266949.8code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.