CVE-2026-3392: fascinatedbox lily Improper Resource Shutdown or Release

Vulnerability summary

CVE-2026-3392 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in fascinatedbox lily. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-03-2026
   PublishedVulnerability first disclosed.
2. 02-03-2026
   Last modifiedVulnerability information updated.

Description

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.