CVE-2026-116740: libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser
libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mqparsemediaquery() that allows remote attackers to crash consumers by supplying media lists ending in a comma. Attackers can serve a stylesheet whose @media or @import media list has a trailing comma, causing NetSurf or other parsers to crash.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the crash?
An attacker must cause a libcss consumer to parse a stylesheet containing an @media or @import media list that ends with a trailing comma. This malformed media-query input reaches mq_parse_media_query() and triggers the NULL pointer dereference.
Who is exposed to this issue?
Applications that use affected libcss versions and parse attacker-controlled or remotely served stylesheets are exposed. The description specifically identifies NetSurf and other consumers of the library.
What is the practical impact of successful exploitation?
Successful exploitation crashes the consuming application, resulting in a denial of service. The supplied data does not indicate confidentiality or integrity impact.