CVE-2026-3392
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Mar 1, 2026
CISA due date
—
The record
A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | apache-pdfbox | 0 | 2.0.36-160000.1.1 |
| openSUSE:Tumbleweed | apache-pdfbox | 0 | 2.0.36-1.1 |
Related vulnerabilities
- CVE-2026-33929 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… Also affects apache-pdfbox
- CVE-2026-109277 ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script… CWE-404
- CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. CWE-404
- CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. CWE-404
- CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. CWE-404
- CVE-2026-91779 A security flaw has been discovered in GNU Binutils 2.47. CWE-404
- CVE-2026-90829 A weakness has been identified in GNU Binutils 2.47. CWE-404