Junglewise Threat Intelligence

CVE-2026-10268: janet-lang Janet integer overflow in unmarshal_one_fiber

CVE-2026-10268 · Severity: low · CVSS 3.3 · Published 2026-06-01

Executive brief

Janet is a programming language and bytecode virtual machine used for automation and embedding in C/C++ applications. A vulnerability in how the language handles serialized data (unmarshaling) can allow a local attacker to crash the application or potentially corrupt its memory. This occurs when the system processes a specially crafted file or data stream, leading to a service outage or a potential foothold for further attacks.

Technical details

An integer overflow exists in the `unmarshal_one_fiber` function in `src/core/marsh.c` of the Janet programming language. The vulnerability occurs because `fiber_stacktop` is read directly from attacker-controlled serialized data via `readnat()` without sufficient bounds checking. When `fiber_stacktop` is set to a high value (e.g., INT32_MAX), the calculation `fiber->capacity = fiber_stacktop + 10` overflows. On 64-bit systems, this results in an extremely large `malloc` request leading to a crash (DoS). On 32-bit systems, the overflow results in a small heap allocation followed by a large write loop, causing a heap buffer overflow that could potentially lead to remote code execution. The issue has been addressed in commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d.

Affected products

  • janet-lang Janet up to 1.41.0

Timeline

  • 2026-04-26: disclosed: Issue reported on GitHub by biniamf
  • 2026-06-01: advisory: NVD publication date
  • 2026-06-01: patched: Patch commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d identified

References

Related threats