Libcss
Monthly
A NULL pointer dereference in libcss through 0.9.2 lets remote attackers crash any application that parses an attacker-supplied stylesheet whose @media or @import media query list ends in a trailing comma, taking down NetSurf and other embedders of the library. The fault sits in mq_parse_media_query() (src/parse/mq.c), where the final iteration of the media-list loop hands a NULL token to a branch that dereferences it unchecked; the regression tests added with the fix ('@media),', '@media ),,,', '@media (color),') confirm the exact trigger. Impact is availability only - a client-side parse-time crash with no code execution or data disclosure, and it requires the victim to load the hostile CSS (passive user interaction). No confirmed public exploit code was identified at time of analysis, though a public technical writeup describing the dereference exists; EPSS is low at 0.33% (26th percentile) and there is no CISA KEV listing, so this is a moderate-priority denial-of-service issue rather than a top-tier emergency.
A NULL pointer dereference in libcss through 0.9.2 lets remote attackers crash any application that parses an attacker-supplied stylesheet whose @media or @import media query list ends in a trailing comma, taking down NetSurf and other embedders of the library. The fault sits in mq_parse_media_query() (src/parse/mq.c), where the final iteration of the media-list loop hands a NULL token to a branch that dereferences it unchecked; the regression tests added with the fix ('@media),', '@media ),,,', '@media (color),') confirm the exact trigger. Impact is availability only - a client-side parse-time crash with no code execution or data disclosure, and it requires the victim to load the hostile CSS (passive user interaction). No confirmed public exploit code was identified at time of analysis, though a public technical writeup describing the dereference exists; EPSS is low at 0.33% (26th percentile) and there is no CISA KEV listing, so this is a moderate-priority denial-of-service issue rather than a top-tier emergency.