Every CVE Search/ Get API key

CVE-2026-3392

FascinatedBox lily lily_emitter.c eval_tree null pointer dereference

4.8 Medium

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.19%Up 0.2 points since Mar 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

FascinatedBox lily lily_emitter.c eval_tree null pointer dereference

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-3392
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR
Weakness
CWE-476, CWE-404
Updated
2026-11-02
EUVDEUVD-2026-9127 4.8

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Record
EUVD-2026-9127
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-wjxq-hxc4-r33w 1.9

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the...

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Record
GHSA-wjxq-hxc4-r33w
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
NVD 1.9

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-3392
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSV 1.9

FascinatedBox lily lily_emitter.c eval_tree null pointer dereference

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Record
CVE-2026-3392
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSVopenSUSE-SU-2026:10550-1 No score

apache-pdfbox-2.0.36-1.1 on GA media

These are all security issues fixed in the apache-pdfbox-2.0.36-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10550-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20923-1 No score

Security update for apache-pdfbox

This update for apache-pdfbox fixes the following issues:

Update to version 2.0.36.

Security issues fixed:

  • CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes (bsc#1262046).

Other updates and bugfixes:

  • Version 2.0.36:
    • XMPBox removes namespaces on serialization
    • False negative on PDFA-1b validation : missing field type
    • PlainText.Paragraph.getLines extremely slow on long lines
    • Valid PDF/A 1B is rejected
    • Potential StackOverflows in BaseParser
    • Unknown code in Huffman RLE stream
    • IllegalArgumentException: Can't add attribute to 0-length text
    • TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing ConcurrentModificationException to be thrown
    • IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()
    • Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4 document
    • allow new PDF/A-4 conformance levels
    • pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)
    • Cmd line docs
    • IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()
    • XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • NullPointerException in FontMapperImpl.getFontMatches()
    • border style in FDFAnnotation is not initialized if width is 0
    • German umlauts are not rendered
    • Invalid type in Schema not detected when in XML attributes
    • Serializing produces date "1-01-01T00:00:00+01:00"
    • Seconds of date "D:2015-02-03T10:11:12" returned as 0
    • Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema
    • ClassCastException in XMPMediaManagementSchema.getHistory()
    • IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()
    • IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with RASTERIZE_DPI_AUTO
    • DateConverter fails on valid date
    • ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()
    • tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality
    • ClassCastException: class org.apache.xmpbox.type.FlashType
    • Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property: rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action
    • XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode
    • XmpParsingException: Unknown property value type : Open Choice of Integer
    • XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/
    • date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"
    • XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in lenient mode
    • Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/ http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas
    • NegativeArraySizeException in PredictorOutputStream()
    • NullpointerException in PDAcroForm.getField(Line 485)
    • OutOfMemoryError when trying to extract text from pdf
    • Outlines circular reference vulnerability
    • Rendered text missing
    • Inverted images due to enlarged decode array
    • PDF displays garbled characters in Adobe Reader but renders correctly in web browsers
    • NullPointerException while merging PDFs with output intents
    • Valid XMP Extension Schema rejected
    • Remove dead code from PDFMarkedContentExtractor
    • Include test file in test class
    • Get and Add PageTextSchema
    • Remove / deprecate TypeMapping.getAssociatedSchemaObject()
    • Support Seq / Bag mixup in lenient mode -…
Record
openSUSE-SU-2026:20923-1
Updated
2026-11-02
OSVSUSE-SU-2026:22088-1 No score

Security update for apache-pdfbox

This update for apache-pdfbox fixes the following issues:

Update to version 2.0.36.

Security issues fixed:

  • CVE-2026-33929: path traversal in the ExtractEmbeddedFiles example code can lead to arbitrary file writes (bsc#1262046).

Other updates and bugfixes:

  • Version 2.0.36:
    • XMPBox removes namespaces on serialization
    • False negative on PDFA-1b validation : missing field type
    • PlainText.Paragraph.getLines extremely slow on long lines
    • Valid PDF/A 1B is rejected
    • Potential StackOverflows in BaseParser
    • Unknown code in Huffman RLE stream
    • IllegalArgumentException: Can't add attribute to 0-length text
    • TTFSubsetter.buildGlyfTable() modifies glyphIds while iterating over its entries possibly causing ConcurrentModificationException to be thrown
    • IndexOutOfBoundsException in Type1CharStringParser.processCallSubr()
    • Exception "No type defined for {http://www.aiim.org/pdfa/ns/id/}rev" when trying to determine version of PDF/A-4 document
    • allow new PDF/A-4 conformance levels
    • pdfbox-app-X.X.X-sources.jar on maven central are empty (and javadoc jar is missing)
    • Cmd line docs
    • IllegalArgumentException: Multiplying two matrices produces illegal values in PDFStreamEngine.processAnnotation()
    • XmpParsingException: Schema is not set in this document: http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
    • NullPointerException in FontMapperImpl.getFontMatches()
    • border style in FDFAnnotation is not initialized if width is 0
    • German umlauts are not rendered
    • Invalid type in Schema not detected when in XML attributes
    • Serializing produces date "1-01-01T00:00:00+01:00"
    • Seconds of date "D:2015-02-03T10:11:12" returned as 0
    • Confusing naming of "DerivedFrom" property getter in XMPMediaManagementSchema
    • ClassCastException in XMPMediaManagementSchema.getHistory()
    • IllegalArgumentException: Input buffer too short in StandardSecurityHandler.computeRC4key()
    • IllegalArgumentException: Width (0) and height (0) cannot be <= 0 when printing landscape rotated with RASTERIZE_DPI_AUTO
    • DateConverter fails on valid date
    • ClassCastException: class org.apache.xmpbox.type.TextType cannot be cast to class org.apache.xmpbox.type.ArrayProperty in DublinCoreSchema.getCreatorsProperty()
    • tiff:YCbCrSubSampling and tiff:YCbCrPositioning have wrong cardinality
    • ClassCastException: class org.apache.xmpbox.type.FlashType
    • Cannot find a definition for the namespace http://www.w3.org/1999/02/22-rdf-syntax-ns#, property: rdf:Description http://ns.adobe.com/xap/1.0/sType/ResourceEvent#, property:stEvt:action
    • XmpParsingException: Missing pdfaSchema:property in type definition in lenient mode
    • XmpParsingException: Unknown property value type : Open Choice of Integer
    • XmpParsingException: Property 'CountryCode' not defined in http://www.epo.org/patent-bibliographic-data/1.0/
    • date "0-00-00T00:00:00-04:00" read as "0002-11-30T00:00:00-40:00"
    • XmpParsingException: Type 'stRef:documentName' not defined in http://ns.adobe.com/xap/1.0/sType/ResourceRef# in lenient mode
    • Invalid PDF/A namespace definition, prefix: xmlns, namespace: http://www.aiim.org/pdfa/ns/extension/ http://www.aiim.org/pdfa/ns/extension/, property: pdfaExtension:schemas
    • NegativeArraySizeException in PredictorOutputStream()
    • NullpointerException in PDAcroForm.getField(Line 485)
    • OutOfMemoryError when trying to extract text from pdf
    • Outlines circular reference vulnerability
    • Rendered text missing
    • Inverted images due to enlarged decode array
    • PDF displays garbled characters in Adobe Reader but renders correctly in web browsers
    • NullPointerException while merging PDFs with output intents
    • Valid XMP Extension Schema rejected
    • Remove dead code from PDFMarkedContentExtractor
    • Include test file in test class
    • Get and Add PageTextSchema
    • Remove / deprecate TypeMapping.getAssociatedSchemaObject()
    • Support Seq / Bag mixup in lenient mode -…
Record
SUSE-SU-2026:22088-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-pdfbox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 2.0.36-160000.1.1
2.0.36-160000.1.1
apache-pdfbox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.0.36-160000.1.1
2.0.36-160000.1.1
apache-pdfbox
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.0.36-1.1
2.0.36-1.1
apache-pdfbox
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.0.36-160000.1.1
2.0.36-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-3392 is a medium vulnerability (CVSS 4.8) in Fascinatedbox Lily, published March 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open