CVE-2026-2660: FascinatedBox Lily Use After Free Flaw

CVE-2026-2660 Overview

A use after free vulnerability has been identified in FascinatedBox lily, a programming language interpreter, affecting versions up to 2.3. The vulnerability exists in the shorthash_for_name function within the file src/lily_symtab.c. This memory corruption flaw can be triggered through manipulation of the symbol table handling, potentially leading to denial of service or unexpected behavior. The exploit is publicly available and has been reported through the project's issue tracker, though the maintainers have not yet responded to the disclosure.

Critical Impact

Local attackers with basic privileges can exploit this use after free vulnerability to cause application crashes or potentially corrupt memory, affecting systems running vulnerable versions of the Lily programming language interpreter.

Affected Products

• FascinatedBox lily versions up to 2.3
• Systems running the Lily programming language interpreter
• Applications embedding the Lily interpreter library

Discovery Timeline

• 2026-02-18 - CVE-2026-2660 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2660

Vulnerability Analysis

This vulnerability is classified as a use after free (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) memory corruption issue. The flaw resides in the shorthash_for_name function located in src/lily_symtab.c, which is responsible for handling symbol table operations in the Lily interpreter.

Use after free vulnerabilities occur when a program continues to reference memory after it has been deallocated. In this case, the symbol table management code appears to access freed memory during hash operations on symbol names. This can lead to undefined behavior, including crashes, data corruption, or potentially more severe impacts depending on how the freed memory is subsequently reused.

The vulnerability requires local access to exploit, meaning an attacker would need the ability to execute Lily scripts or interact directly with the interpreter on the target system.

Root Cause

The root cause of this vulnerability is improper memory management in the symbol table implementation. The shorthash_for_name function appears to access memory that has already been freed, likely due to:

• Improper tracking of memory allocation lifetimes
• Missing validation checks before accessing symbol table entries
• Race conditions or incorrect ordering of deallocation and access operations

The memory safety issue allows references to persist after their backing memory has been released back to the allocator.

Attack Vector

The attack vector for CVE-2026-2660 requires local access to the target system. An attacker would need to:

1. Have the ability to execute Lily scripts on the target system
2. Craft a malicious Lily script that triggers the vulnerable code path in shorthash_for_name
3. Manipulate symbol table operations in a way that causes the use after free condition

Reproduction steps have been made publicly available through the GitHub Issue Tracker for Lily. The vulnerability can be triggered using a specifically crafted Lily script that manipulates symbol table entries in a particular sequence.

Since no verified code examples are available, the exploitation mechanism involves crafting Lily source code that causes the interpreter's symbol table to be accessed after relevant memory has been freed during the parsing or execution phase.

Detection Methods for CVE-2026-2660

Indicators of Compromise

• Unexpected crashes or segmentation faults in the Lily interpreter process
• Core dumps indicating memory access violations in lily_symtab.c or related symbol table functions
• Abnormal memory allocation patterns in systems running Lily scripts

Detection Strategies

• Monitor for crashes in Lily interpreter processes with stack traces referencing shorthash_for_name or symbol table operations
• Implement memory sanitizer tools (AddressSanitizer, Valgrind) when running untrusted Lily scripts
• Review application logs for segmentation faults or memory corruption errors related to Lily execution

Monitoring Recommendations

• Enable core dump collection for Lily interpreter processes to capture crash diagnostics
• Implement process monitoring to detect repeated crashes that may indicate exploitation attempts
• Consider sandboxing or containerizing Lily interpreter execution to limit potential impact

How to Mitigate CVE-2026-2660

Immediate Actions Required

• Avoid executing untrusted Lily scripts on production systems until a patch is available
• Restrict access to systems running the Lily interpreter to trusted users only
• Monitor the Lily GitHub repository for security updates and patches
• Consider deploying memory sanitization tools in development and testing environments

Patch Information

At the time of publication, no official patch has been released by the Lily project maintainers. The vulnerability was reported through GitHub Issue #385, but the project has not yet responded to the disclosure. Users should monitor the official Lily repository for updates and apply patches as soon as they become available.

Additional vulnerability details can be found at VulDB #346458.

Workarounds

• Restrict execution of Lily scripts to trusted sources only
• Run the Lily interpreter in a sandboxed environment with limited privileges
• Implement process isolation using containers or virtual machines for untrusted code execution
• Use memory protection mechanisms such as ASLR and stack canaries to reduce exploitation impact

# Example: Running Lily in a restricted environment
# Create a restricted user for Lily execution
useradd -r -s /bin/false lily-runner

# Run Lily scripts with reduced privileges
sudo -u lily-runner lily untrusted_script.lily

# Alternatively, use a container for isolation
docker run --rm --read-only --network=none -v /path/to/script:/script:ro lily-container lily /script/untrusted.lily