Executive brief
Janet is a programming language and bytecode virtual machine used for system scripting and embedding within C/C++ applications. A security flaw in its debugging component allows a local attacker to read sensitive information from the computer's memory that should otherwise be inaccessible. This could lead to the exposure of internal program data or cause the application to crash, potentially disrupting operations.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the `doframe` function within `src/core/debug.c` of the Janet programming language. The root cause is a failure to validate the `slot_index` from a `symbolmap` when unmarshalling untrusted data in `src/core/marsh.c`. A local attacker can provide a crafted marshal payload that, when unmarshalled into a fiber and inspected via `debug/stack`, causes the VM to read memory outside the allocated stack frame. This can result in the disclosure of adjacent heap memory or a denial-of-service (DoS) via application crash. The issue is fixed in commit ed17dd2c5913a23fb1107251e44a9410a3c30cf5 by adding runtime checks to `janet_verify`.
Affected products
- janet-lang Janet up to 1.41.0
Timeline
- 2026-06-01: advisory: NVD publication date
- 2026-06-01: disclosed: Vulnerability reported via VulDB and GitHub issues
References
- https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oobread
- https://github.com/janet-lang/janet/
- https://github.com/janet-lang/janet/commit/ed17dd2c5913a23fb1107251e44a9410a3c30cf5
- https://github.com/janet-lang/janet/issues/1743
- https://github.com/janet-lang/janet/issues/1743
- https://vuldb.com/cve/CVE-2026-10267
- https://vuldb.com/submit/825072