CVE-2026-2662: FascinatedBox lily Out-of-Bounds Read Flaw

CVE-2026-2662 Overview

A memory safety vulnerability has been identified in FascinatedBox lily up to version 2.3. This vulnerability affects the count_transforms function in the file src/lily_emitter.c, resulting in an out-of-bounds read condition. The vulnerability requires local access to exploit and could allow an attacker with local privileges to read memory beyond allocated boundaries, potentially leading to information disclosure or application crashes.

Critical Impact

Local attackers can trigger an out-of-bounds read in the lily programming language interpreter, potentially causing denial of service or information leakage through memory disclosure.

Affected Products

• FascinatedBox lily up to version 2.3
• Applications embedding the lily interpreter
• Systems running lily scripts from untrusted sources

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-2662 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2662

Vulnerability Analysis

This vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw exists in the count_transforms function within src/lily_emitter.c, which is responsible for processing code transformations during the compilation/emission phase of the lily interpreter.

The out-of-bounds read occurs when the function fails to properly validate array boundaries before accessing memory. When processing specially crafted input, the function attempts to read beyond the allocated buffer, accessing adjacent memory regions that may contain sensitive data or cause the application to crash.

A proof-of-concept reproduction file has been made publicly available, demonstrating the exploitability of this vulnerability. The project maintainers were informed of the issue through GitHub Issue #381, but no response has been received at the time of disclosure.

Root Cause

The root cause of this vulnerability is insufficient bounds checking in the count_transforms function. The function processes transformation data without adequately verifying that array indices remain within valid memory boundaries. This improper input validation allows maliciously crafted lily scripts to trigger memory access violations.

Attack Vector

The attack requires local access to the target system. An attacker must be able to execute or provide lily scripts to the interpreter. The exploitation scenario involves:

1. Crafting a malicious lily script that triggers the vulnerable code path
2. Providing the script to the lily interpreter
3. The interpreter processes the script and calls count_transforms
4. The vulnerable function reads beyond buffer boundaries

Since the exploit has been made publicly available, attackers with local access could leverage the provided reproduction case to trigger the vulnerability. The attack does not require any user interaction beyond script execution.

Detection Methods for CVE-2026-2662

Indicators of Compromise

• Unexpected crashes or segmentation faults in lily interpreter processes
• Memory access violations logged in system crash reports related to lily_emitter.c
• Abnormal behavior when processing untrusted lily scripts
• Core dumps showing out-of-bounds memory access patterns

Detection Strategies

• Deploy memory sanitizers (AddressSanitizer, Valgrind) in development and testing environments to catch out-of-bounds reads
• Monitor for crashes in lily-based applications with stack traces pointing to count_transforms or lily_emitter.c
• Implement file integrity monitoring for lily script files to detect unauthorized modifications
• Use endpoint detection and response (EDR) solutions to identify abnormal memory access patterns

Monitoring Recommendations

• Enable crash reporting and analysis for systems running lily interpreter
• Configure logging for lily interpreter execution to track script processing anomalies
• Implement sandboxing for lily script execution to contain potential exploitation attempts
• Monitor system logs for repeated interpreter crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-2662

Immediate Actions Required

• Avoid executing untrusted lily scripts until a patch is available
• Implement sandboxing or containerization for lily script execution environments
• Restrict local access to systems running lily-based applications
• Monitor the FascinatedBox lily GitHub repository for security updates

Patch Information

No official patch is currently available. The project maintainers were informed of the vulnerability through GitHub Issue #381 but have not yet responded. Users should monitor the official repository for updates and apply patches as soon as they become available.

For technical details and reproduction steps, refer to the VulDB entry and the reproduction example.

Workarounds

• Run lily scripts only from trusted sources with validated integrity
• Deploy lily interpreter in isolated environments (containers, VMs, or sandboxes) to limit impact
• Implement input validation at the application layer before passing scripts to the interpreter
• Consider disabling lily functionality in production environments until a patch is released
• Apply principle of least privilege to accounts running lily-based applications