CVE-2026-3392 identifies a null pointer dereference vulnerability in the FascinatedBox lily project, specifically affecting versions 2.0 through 2.3. The vulnerability resides in the eval_tree function of the src/lily_emitter.c source file. When this function processes certain crafted inputs or internal states, it attempts to dereference a null pointer, causing the application to crash. This flaw is exploitable only by local users with limited privileges, as it requires local execution access and no user interaction or authentication is necessary beyond local presence. The impact is primarily a denial of service (DoS) condition, as the application terminates unexpectedly. The vulnerability was responsibly disclosed via an issue report prior to public release, but the project maintainers have not yet issued a patch or response. The availability of a public exploit increases the risk of local DoS attacks, especially in multi-user or shared environments where lily is used. The CVSS v4.0 base score is 4.8, reflecting medium severity due to the limited attack vector and impact scope. No remote exploitation or privilege escalation is possible through this vulnerability. The lack of vendor response and patch availability means users must rely on workarounds or mitigations until an official fix is released.

The primary impact of this vulnerability is denial of service through application crashes caused by null pointer dereference. Organizations using FascinatedBox lily in environments where multiple users have local access could face service interruptions or instability. This may affect development workflows, automated processes, or any systems relying on lily for code emission or compilation tasks. Since the vulnerability does not allow remote exploitation or privilege escalation, the risk is contained to local users who already have some access. However, in shared or multi-tenant systems, an attacker could disrupt services or cause downtime, potentially impacting productivity and operational continuity. The presence of a public exploit increases the likelihood of opportunistic attacks. The lack of a patch prolongs exposure, requiring organizations to implement compensating controls. Overall, the impact is moderate but could be significant in environments where lily is critical and local user access is common.

To mitigate CVE-2026-3392, organizations should restrict local access to systems running FascinatedBox lily to trusted users only, minimizing the risk of exploitation by unprivileged local attackers. Employ strict access controls and monitoring on development or build servers where lily is installed. Consider running lily processes with the least privileges necessary and isolate them in containers or sandboxed environments to limit the blast radius of a crash. Until an official patch is released, users can implement application-level monitoring to detect crashes and automatically restart services to reduce downtime. Reviewing and sanitizing inputs or scripts processed by lily may help avoid triggering the vulnerable code path. Engage with the vendor or open-source maintainers to encourage timely patching. Additionally, maintain up-to-date backups and incident response plans to quickly recover from potential disruptions caused by exploitation attempts.