{"id":"CVE-2026-116740","kind":"vulnerability","aliases":["CVE-2026-116740"],"related":[],"title":"libcss: trailing comma in media query crashes CSS parsers","description":"libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.","summary":"libcss through 0.9.2 dereferences a NULL pointer in mq_parse_media_query() when a media list ends in a comma. A remote attacker who serves a stylesheet with such an @media or @import rule can crash NetSurf or any other program that parses it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libcss","netsurf","package"],"not_affected_if":["no-libcss-usage"],"how_to_check":"- `unknown`","fix":"- Move libcss past `0.9.2` once a fixed release is published; check the NVD entry for the patched version.","status":"open","published_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:40+00:00","updated_at":"2026-10-26T22:27:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T22:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move libcss past `0.9.2` once a fixed release is published; check the NVD entry for the patched version.","reach":"internet","title":"libcss: trailing comma in media query crashes CSS parsers","impact":"low","summary":"libcss through 0.9.2 dereferences a NULL pointer in mq_parse_media_query() when a media list ends in a comma. A remote attacker who serves a stylesheet with such an @media or @import rule can crash NetSurf or any other program that parses it.","category":"package","nicknames":[],"who_cares":["libcss","netsurf","c"],"confidence":0.5,"needs_auth":"no","worst_case":"Remote crash of the parsing program; no code execution stated.","analyst_note":"Find the fixed libcss version and confirm whether the flaw allows more than a crash, using the NVD entry and the libcss project repository.","how_to_check":"- `unknown`","needs_analyst":true,"not_affected_if":["no-libcss-usage"],"who_is_affected":"Any application that embeds libcss and parses untrusted stylesheets, such as the NetSurf browser or other tools built on libcss. The sources do not say whether other libcss consumers or default builds are affected beyond the crash described. Teams that do not use libcss can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3337,"output_tokens":480,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116740':12A,15A '-2026':11A,14A '0.9.2':22B,65C 'allow':78C 'attack':42B,80C,92C 'c':16B 'caus':107C 'comma':3A,39B,91C,106C 'consum':83C 'contain':66C 'crash':7A,55B,82C,113C 'css':8A 'cve':10A,13A 'derefer':23B,70C 'end':36B,88C 'import':52B,100C 'libcss':1A,17B,20B,63C 'list':35B,87C,102C 'media':5A,30B,34B,50B,75C,86C,98C,101C 'mq':28B,73C 'netsurf':18B,56B,108C 'null':25B,68C 'packag':19B 'pars':29B,62B,74C 'parser':9A,111C 'pointer':26B,69C 'program':60B 'queri':6A,31B,76C 'remot':41B,79C 'rule':53B 'serv':44B,94C 'stylesheet':46B,96C 'suppli':85C 'trail':2A,105C 'vulner':71C 'whose':97C","nicknames":[],"mitigations":[],"who_affected":"Any application that embeds libcss and parses untrusted stylesheets, such as the NetSurf browser or other tools built on libcss. The sources do not say whether other libcss consumers or default builds are affected beyond the crash described. Teams that do not use libcss can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116740","severity":null,"published_at":"2026-10-26T22:16:58+00:00","modified_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}