Executive brief
Janet is a programming language and bytecode virtual machine used for automation and embedding in C/C++ applications. A vulnerability in how the language handles serialized data (unmarshaling) can allow a local attacker to crash the application or potentially corrupt its memory. This occurs when the system processes a specially crafted file or data stream, leading to a service outage or a potential foothold for further attacks.
Technical details
An integer overflow exists in the `unmarshal_one_fiber` function in `src/core/marsh.c` of the Janet programming language. The vulnerability occurs because `fiber_stacktop` is read directly from attacker-controlled serialized data via `readnat()` without sufficient bounds checking. When `fiber_stacktop` is set to a high value (e.g., INT32_MAX), the calculation `fiber->capacity = fiber_stacktop + 10` overflows. On 64-bit systems, this results in an extremely large `malloc` request leading to a crash (DoS). On 32-bit systems, the overflow results in a small heap allocation followed by a large write loop, causing a heap buffer overflow that could potentially lead to remote code execution. The issue has been addressed in commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d.
Affected products
- janet-lang Janet up to 1.41.0
Timeline
- 2026-04-26: disclosed: Issue reported on GitHub by biniamf
- 2026-06-01: advisory: NVD publication date
- 2026-06-01: patched: Patch commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d identified
References
- https://github.com/biniamf/pocs/tree/main/janet-marsh-unmarshal-intovf
- https://github.com/janet-lang/janet/
- https://github.com/janet-lang/janet/commit/d9b1d711ea1fde52ac73a82088b512a3e17bad0d
- https://github.com/janet-lang/janet/issues/1744
- https://vuldb.com/cve/CVE-2026-10268
- https://vuldb.com/submit/825075
- https://vuldb.com/vuln/367547