CVE-2026-2662

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count_transforms of the file src/lily_emitter.c. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-125 CWE-787

Affected software

Vendor	Product	Versions
FascinatedBox	lily	2.0; 2.1; 2.2; 2.3

References

https://github.com/FascinatedBox/lily/Product
https://github.com/FascinatedBox/lily/issues/381Exploit, Issue Tracking, Third Party Advisory
https://github.com/oneafter/0122/blob/main/i381/repro.lilyExploit
https://vuldb.com/?ctiid.346460Permissions Required, VDB Entry
https://vuldb.com/?id.346460Third Party Advisory, VDB Entry
https://vuldb.com/?submit.753166Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-26636.3A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /CVE-2026-26647.8An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up CVE-2026-26656.3A vulnerability was detected in huanzi-qch base-admin up to 57a8126bb3353a004f3c7722089e3b926ea83596. Impacted is the function Upload of the CVE-2026-26667.2A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the comp CVE-2026-26675.3A vulnerability has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. The impacted element is an unk CVE-2026-266737.5An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via CVE-2026-26687.3A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of CVE-2026-266827.8An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component CVE-2026-26696.5A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown functi CVE-2026-266949.8code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.CVE-2026-266959.8code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.CVE-2026-266969.8code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.