CVE-2026-3391

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-339108.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.CVE-2026-339115.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST CVE-2026-339125.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authen CVE-2026-339134.9OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authen CVE-2026-339147.2OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostC CVE-2026-339155.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insu CVE-2026-339164.7Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Ha CVE-2026-339178.8OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a CVE-2026-339188.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billi CVE-2026-33925.5A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.CVE-2026-339203.5A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of t CVE-2026-339215.2The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to ev