EUVD-2026-110488
GHSA-gmc2-wjcf-43vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious stylesheet with trailing-comma media list
-
ExploitVictim browser/app fetches and parses the CSS
-
ExecutionParser reaches NULL token after final query
-
ImpactDereference in mq_parse_media_query crashes consumer (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Triggering requires the victim application to parse an attacker-controlled stylesheet whose @media or @import media query list ends with a trailing comma (confirmed by the regression tests '@media),', '@media ),,,', '@media (color),'); on that input the final iteration of the media-list loop passes a NULL token into mq_parse_media_query(), which the unpatched code dereferences. Exploitation is LIMITED by the need for the victim to load/parse the malicious CSS (CVSS UI:P / passive user interaction) - this is a client-side parse-time crash, not a server-side unauthenticated hit - and by the use of libcss ≤0.9.2 (NetSurf or any embedding consumer). Impact is confined to a crash (availability only); it does not grant code execution or data disclosure. |
| Impact | The signals are internally consistent and point to a moderate-severity denial-of-service issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 7.1 driven ENTIRELY by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), matching CWE-476 and the commit evidence - the only outcome is a crash of the consuming application. EPSS is low at 0.33% (26th percentile) and the CVE is NOT in CISA KEV, so there is no indication of active or widespread exploitation; this is consistent with a crash-only bug that yields no code execution or data access and therefore has limited attacker incentive. The vuln.today decision label is 'this_week' and a vendor patch exists, supporting prompt but non-emergency patching. The one nuance: exploitation requires the victim to load attacker-supplied CSS (UI:P / passive interaction), which tempers the 'network' vector - it is not a server-side unauthenticated crash but a client-side parse-time crash. Net: a genuine, easily-triggered DoS worth patching soon, not a high-CVSS-but-illusory issue, but also not an RCE-class priority. |
| Exploit ScenarioDerived | An attacker publishes a web page or stylesheet whose @media or @import media list ends with a trailing comma (e.g. '@media (color),'). When a NetSurf user - or any application embedding libcss ≤0.9.2 - loads and parses that CSS, mq_parse_media_query() advances past the final media query, receives a NULL token, and dereferences it, crashing the consumer. A public write-up (hackmd) and a VulnCheck advisory describing the flaw exist, but the input does not confirm them as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A NULL pointer dereference in libcss through 0.9.2 lets remote attackers crash any application that parses an attacker-supplied stylesheet whose @media or @import media query list ends in a trailing comma, taking down NetSurf and other embedders of the library. The fault sits in mq_parse_media_query() (src/parse/mq.c), where the final iteration of the media-list loop hands a NULL token to a branch that dereferences it unchecked; the regression tests added with the fix ('@media),', '@media ),,,', '@media (color),') confirm the exact trigger. Impact is availability only - a client-side parse-time crash with no code execution or data disclosure, and it requires the victim to load the hostile CSS (passive user interaction). No confirmed public exploit code was identified at time of analysis, though a public technical writeup describing the dereference exists; EPSS is low at 0.33% (26th percentile) and there is no CISA KEV listing, so this is a moderate-priority denial-of-service issue rather than a top-tier emergency.
RemediationAI
Apply the upstream fix in commit 006ffc4096040da13690abc380e5f828ec08284d, which adds the missing 'token != NULL' check in mq_parse_media_query() and ships regression tests for trailing-comma media lists; the vendor is reported as having a patch available, and this one-line guard backports cleanly into embedded or vendored copies of libcss, but a tagged release version past 0.9.2 containing the fix is not independently confirmed in the supplied data, so verify against the project's release tags before assuming a packaged update covers you. Consumers that cannot immediately re-link libcss (NetSurf builds, downstream distros, firmware using the library) should treat the crash as an input-validation problem in the interim: strip or reject trailing commas in @media and @import media lists before handing a stylesheet to libcss, or refuse to parse stylesheets from untrusted sources entirely, accepting that both workarounds trade fidelity for safety and will mangle otherwise-valid CSS. Blocking or sandboxing the parser process limits the fallout of a crash but does not remove the dereference. Monitor for a patched libcss release and for the advisory pages at https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d and https://nvd.nist.gov/vuln/detail/CVE-2026-116740.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libcss is the Cascading Style Sheets parsing and selection library written for the NetSurf browser and reused by other lightweight HTML/CSS consumers. The flaw is CWE-476 (NULL pointer dereference) in the media-query parser: mq_parse_media_query() walks the token stream of a media list, and when the list terminates with a trailing comma the loop reaches a final iteration with no token available, passing NULL into a branch that reads token->type. The upstream fix (commit 006ffc4096040da13690abc380e5f828ec08284d) is a single guard changing the condition to 'token != NULL && token->type == CSS_TOKEN_IDENT', which confirms the root cause is an unvalidated pointer rather than a logic or memory-corruption bug. The same commit extends test/data/parse2/mq.dat with three cases that must parse cleanly, including '@media),', '@media ),,,' and '@media (color),'. Scoring reflects availability-only impact: CVSS 4.0 rates it 7.1 with AV:N/AC:L/AT:N/PR:N/UI:P and VA:H but VC:N/VI:N, and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H agrees that a successful trigger yields nothing beyond a crash. Because the parsing library is embedded rather than exposed as a service, the network vector describes delivery of the stylesheet, not direct reachability of a server-side component.
Know when Libcss gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker-served stylesheet over the network with no auth (AV:N/PR:N) but the victim must load/parse it (UI:R); the flaw only crashes the parser, so A:H with C:N/I:N and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
Executive ViewAI
A high-severity availability vulnerability in the libcss library (through version 0.9.2) allows a remote attacker to crash applications that parse attacker-supplied stylesheets, specifically affecting NetSurf and other embedders. The impact is limited to denial-of-service, requiring user interaction to load malicious CSS, with no risk of code execution or data disclosure-though this could degrade service availability for affected products.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB