Live › vulnerability › CVE-2026-116740
Go to dashboardlibcss through 0.9.2 dereferences a NULL pointer in mq_parse_media_query() when a media list ends in a comma. A remote attacker who serves a stylesheet with such an @media or @import rule can crash NetSurf or any other program that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Any application that embeds libcss and parses untrusted stylesheets, such as the NetSurf browser or other tools built on libcss. The sources do not say whether other libcss consumers or default builds are affected beyond the crash described. Teams that do not use libcss can skip it.
No product ranges from the sources yet.
unknown0.9.2 once a fixed release is published; check the NVD entry for the patched version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-116740")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.