janet-lang janet up to 1.41.0 src/core/marsh.c unmarshal_one_fiber integer overflow

Summaryinfo

A vulnerability was found in janet-lang janet up to 1.41.0. It has been classified as problematic. This issue affects the function unmarshal_one_fiber of the file src/core/marsh.c. The manipulation leads to integer overflow. This vulnerability is uniquely identified as CVE-2026-10268. Local access is required to approach this attack. Moreover, an exploit is present. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in janet-lang janet up to 1.41.0 and classified as problematic. This issue affects the function unmarshal_one_fiber of the file src/core/marsh.c. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-10268. The exploitation is known to be easy. Attacking locally is a requirement. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept.

Applying the patch d9b1d711ea1fde52ac73a82088b512a3e17bad0d is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• janet-lang

Name

• janet

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41.0

License

• open-source

Website

• Product: https://github.com/janet-lang/janet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #825075: janet-lang janet 1.41.0 Integer Overflow (by biniam)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion