EUVD-2026-33654
GHSA-mmcx-pc5f-m5m4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.
AnalysisAI
Out-of-bounds read in janet-lang/janet up to version 1.41.0 allows a local low-privileged attacker to read memory beyond allocated bounds via the doframe debug introspection function in src/core/debug.c. The root cause is missing bounds validation when using symbolmap entries (specifically jsm.death_pc and jsm.slot_index) as array indices into function environments and stack data. No public exploit identified at time of analysis, but publicly available exploit code exists per the POC reference; real-world impact is limited to low-confidence local reads with no availability or integrity consequence (CVSS:4.0 score 1.9).
Technical ContextAI
Janet is a functional and imperative scripting language implemented in C. The vulnerability resides in the doframe() function (src/core/debug.c), which performs stack-frame introspection for the debugger. Each JanetSymbolMap entry carries a death_pc field that is repurposed (dual-encoded) to store an environment index when birth_pc is UINT32_MAX, and a slot_index field pointing into that environment or the current stack. Pre-patch, neither field was validated against the bounds of the envs[] array (environments_length) nor the env->length before dereferencing - enabling an out-of-bounds read of heap or fiber stack data. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) precisely describes this class: the symbolmap data arrives from bytecode that is parsed without being fully verified, so a crafted function definition can supply arbitrary index values. The fix (commit ed17dd2c) adds bounds checks in both bytecode.c (janet_verify) and debug.c (doframe), and adds a comment in compile.c clarifying the death_pc dual-encoding contract.
RemediationAI
Apply the upstream fix by updating to a Janet release that incorporates commit ed17dd2c5913a23fb1107251e44a9410a3c30cf5. Users building from source should pull from the janet-lang/janet repository at or after that commit. A released patched version number is not independently confirmed from available data - verify with the upstream release page at https://github.com/janet-lang/janet/ for the first tagged release after this commit. As a compensating control for environments that cannot immediately patch, restrict local shell access to the Janet interpreter to trusted users only, since the vulnerability requires local low-privilege execution. Avoiding untrusted Janet bytecode (e.g., from network sources or third-party packages) also reduces exposure. Disabling Janet debugger use in production deployments is a low-impact workaround given that doframe() is a debug introspection path not required at runtime. The issue was tracked in GitHub issue #1743.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today