CVE-2026-116740 Details
Description
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_parse_media_query() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
A NULL pointer dereference vulnerability has been identified in libcss versions through 0.9.2. The issue arises in the media query parsing function, mq_parse_media_query(). When a media list in an '@media' or '@import' rule ends with a comma, the parser can be tricked into reading past the end of the token vector, leading to a crash. This vulnerability can be exploited by serving a stylesheet with a trailing comma in the media list, causing consumers like the NetSurf browser to crash during parsing.
The vulnerability has been fixed in the upstream libcss repository, but the patch is not yet included in a released version. Users can apply the fix by adding a NULL check in the media query parser before dereferencing the token vector.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netsurf-browser/libcss | [email protected] | Source CodeVendor |
| https://github.com/netsurf-browser/libcss/blob/release/0.9.2/src/parse/mq.c#L984 | [email protected] | Source CodeVendor |
| https://github.com/netsurf-browser/libcss/commit/006ffc4096040da13690abc380e5f828ec08284d | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/libcss-media-list-null-deref | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/libcss-through-0.9.2-null-pointer-dereference-via-media-query-parser | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libcss | <= 0.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |