CVE-2026-3391
📋 TL;DR
CVE-2026-3391 is an out-of-bounds read vulnerability in the clear_storages function of FascinatedBox lily up to version 2.3. This flaw allows local attackers to read memory beyond allocated buffers, potentially exposing sensitive information. Only systems running vulnerable versions of lily with local access are affected.
💻 Affected Systems
- FascinatedBox lily
📦 What is this software?
Lily by Lily Lang
⚠️ Risk & Real-World Impact
Worst Case
Local attacker reads sensitive memory contents, potentially exposing credentials, cryptographic keys, or other confidential data stored in process memory.
Likely Case
Information disclosure of limited memory contents, possibly causing application instability or crashes.
If Mitigated
Minimal impact with proper access controls preventing unauthorized local access to vulnerable systems.
🎯 Exploit Status
Exploit code is publicly available on GitHub, but requires local access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates: https://github.com/FascinatedBox/lily/
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable lily versions
Disable or remove lily
linuxRemove lily from systems where it's not essential
# Linux: sudo apt remove lily or equivalent for your package manager
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local users from accessing systems running lily
- Monitor systems for unusual local user activity and memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check lily version with: lily --version or check installed package versionCheck Version:
lily --versionVerify Fix Applied:
Verify lily version is greater than 2.3 when patch becomes available📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults in lily processes
- Unusual memory access patterns in system logs
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
Process execution of lily with version <= 2.3 OR Application crashes from lily process