CVE-2026-3390

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was identified in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the component Error Reporting. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
FascinatedBox	lily	2.0; 2.1; 2.2; 2.3

References

https://github.com/FascinatedBox/lily/Product
https://github.com/FascinatedBox/lily/issues/382Exploit, Issue Tracking, Vendor Advisory
https://github.com/oneafter/0122/blob/main/i382/repro.lilyExploit
https://vuldb.com/?ctiid.348276Permissions Required, VDB Entry
https://vuldb.com/?id.348276Third Party Advisory, VDB Entry
https://vuldb.com/?submit.761326Third Party Advisory, VDB Entry

Timeline

Published: Mar 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-339007.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-339017.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-339025.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-339036.5Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing a specially crafted NGAP LocationReport CVE-2026-339046.5Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the e CVE-2026-339057.1ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-339067.2Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, the NetworkManager role was granted backup and restore permiss CVE-2026-339076.5Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authenticati CVE-2026-339087.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-339095.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several v CVE-2026-33915.5A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c.CVE-2026-339108.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.