CVE-2026-116740

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116740", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T20:23:36.353Z", "datePublished": "2026-10-26T21:52:39.177Z", "dateUpdated": "2026-10-31T02:01:07.069Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:39.177Z"}, "datePublic": "2026-08-30T00:00:00.000Z", "title": "libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser", "descriptions": [{"lang": "en", "value": "libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "NULL Pointer Dereference", "cweId": "CWE-476", "type": "CWE"}]}], "affected": [{"vendor": "netsurf-browser", "product": "libcss", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "0.9.2"}], "packageURL": "pkg:github/netsurf-browser/libcss", "repo": "https://github.com/netsurf-browser/libcss"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/netsurf-browser/libcss", "tags": ["product"]}, {"url": "https://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/libcss-media-list-null-deref", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}, {"lang": "en", "value": "metan-ucw", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-31T02:00:56.284759Z", "id": "CVE-2026-116740", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T02:01:07.069Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-31T02:00:56.284759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-31T02:01:01.156Z"}}], "cna": {"title": "libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}, {"lang": "en", "type": "remediation developer", "value": "metan-ucw"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/netsurf-browser/libcss", "vendor": "netsurf-browser", "product": "libcss", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.9.2"}], "packageURL": "pkg:github/netsurf-browser/libcss", "defaultStatus": "unaffected"}], "datePublic": "2026-08-30T00:00:00.000Z", "references": [{"url": "https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/netsurf-browser/libcss", "tags": ["product"]}, {"url": "https://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/libcss-media-list-null-deref", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser", "name": "VulnCheck Advisory: libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:39.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116740", "state": "PUBLISHED", "dateUpdated": "2026-10-31T02:01:07.069Z", "dateReserved": "2026-10-26T20:23:36.353Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-26T21:52:39.177Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/netsurf-browser/libcss", "product": "libcss", "repo": "https://github.com/netsurf-browser/libcss", "vendor": "netsurf-browser", "versions": [{"lessThanOrEqual": "0.9.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash."}], "id": "CVE-2026-116740", "lastModified": "2026-10-31T03:17:16.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116740", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-31T02:00:56.284759Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:58.390", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/netsurf-browser/libcss"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/libcss-media-list-null-deref"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libcss: libcss: Denial of Service via media list trailing comma", "id": "2561440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561440"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.", "A flaw was found in libcss. A remote attacker could cause a Denial of Service (DoS) by convincing an application or user to parse a specially crafted stylesheet. When the library processes a media query list ending with a trailing comma, an unhandled null pointer dereference occurs, causing the application to crash."], "name": "CVE-2026-116740", "public_date": "2026-10-26T21:52:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116740\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116740\nhttps://github.com/netsurf-browser/libcss\nhttps://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984\nhttps://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d\nhttps://hackmd.io/@haindpwn/libcss-media-list-null-deref\nhttps://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser"], "statement": "This flaw is assessed as a Moderate severity impact because triggering it requires user interaction to process untrusted style input, confining the blast radius strictly to client-side denial of service. When an application using libcss ingests CSS rules containing trailing punctuation in media declarations, a null reference triggers an unexpected termination of the consumer process. The issue cannot be leveraged for arbitrary code execution, privilege escalation, or unauthorized data exposure. Additionally, libcss is not distributed in supported Red Hat Enterprise Linux releases.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.9.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "libcss", "vendor": "netsurf-browser"}], "created": "2026-10-27T07:45:06.968851+00:00", "updated": "2026-11-03T16:36:58.964872+00:00", "vendors": ["netsurf-browser", "netsurf-browser$PRODUCT$libcss"]}