What’s Vulnerable › Vulnerabilities

CVE-2026-116740: libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-31
• Weakness: CWE-476

Description

libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.

Affected products

• netsurf-browser libcss: through 0.9.2

References

• https://github.com/netsurf-browser/libcss
• https://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984
• https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d
• https://hackmd.io/@haindpwn/libcss-media-list-null-deref
• https://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser

Get alerted when CVE-2026-116740 or the next vulnerability affects your stack