CVE-2026-3392 identifies a NULL pointer dereference vulnerability in FascinatedBox lily, specifically in the eval_tree function of the src/lily_emitter.c source file. This flaw occurs when the function improperly handles certain inputs or states, leading to dereferencing a NULL pointer, which causes the application to crash or terminate unexpectedly. The vulnerability affects versions 2.0 through 2.3 of the lily product. Exploitation is limited to local attackers with low privileges, requiring no user interaction. The vulnerability does not impact confidentiality or integrity but can cause denial of service by crashing the application or process. The issue was responsibly disclosed to the project maintainers, but no patch or response has been provided yet. A proof-of-concept exploit has been publicly released, increasing the risk of local exploitation. The CVSS v4.0 base score is 4.8, reflecting the medium severity due to local attack vector and limited impact scope.

The primary impact of this vulnerability is a denial of service condition caused by application crashes due to NULL pointer dereference. Organizations using FascinatedBox lily in critical local environments may experience service interruptions or instability, potentially affecting development or runtime environments relying on this software. Since exploitation requires local access with low privileges, remote attackers cannot exploit this vulnerability directly. However, insider threats or attackers who have gained limited local access could leverage this flaw to disrupt services. The vulnerability does not expose sensitive data or allow privilege escalation, limiting its impact to availability concerns. The public availability of an exploit increases the risk of opportunistic attacks in environments where lily is deployed.

To mitigate this vulnerability, organizations should implement strict access controls to limit local access to systems running FascinatedBox lily, ensuring only trusted users can execute or interact with the software. Monitoring and alerting for unexpected crashes or application restarts can help detect exploitation attempts. Since no official patch is available yet, consider applying temporary workarounds such as running lily in isolated environments or containers to contain potential crashes. Engage with the vendor or project maintainers to obtain updates or patches as they become available. Additionally, review and harden local user permissions and audit local activity to reduce the risk of exploitation. Regularly update to newer versions once a fix is released.