CVE-2026-2662
📋 TL;DR
This vulnerability allows local attackers to perform out-of-bounds read attacks on FascinatedBox lily software up to version 2.3. The weakness in the count_transforms function could potentially leak sensitive memory information. Only systems running vulnerable versions of lily with local access are affected.
💻 Affected Systems
- FascinatedBox lily
📦 What is this software?
Lily by Lily Lang
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation or sensitive information disclosure through memory content leakage
Likely Case
Information disclosure of adjacent memory contents, potentially revealing sensitive data
If Mitigated
Limited impact due to local-only access requirement and memory randomization
🎯 Exploit Status
Exploit code is publicly available in GitHub repository, but requires local access to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates: https://github.com/FascinatedBox/lily/
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable lily versions
Implement least privilege access controls
Review and restrict local user permissions
Disable or remove lily
allRemove vulnerable software if not essential
sudo apt remove lily
sudo yum remove lily
brew uninstall lily
🧯 If You Can't Patch
- Implement strict access controls to limit who can run lily locally
- Monitor systems for unusual local process execution patterns
🔍 How to Verify
Check if Vulnerable:
Check lily version with: lily --version or check installed package versionCheck Version:
lily --versionVerify Fix Applied:
Verify version is greater than 2.3 when patch becomes available📡 Detection & Monitoring
Log Indicators:
- Unusual local process crashes
- Memory access violation logs
Network Indicators:
- None - local-only vulnerability
SIEM Query:
Process execution of lily with version <= 2.3 by local users