CVE-2026-10267: Out-of-Bounds Read in Janet Language Debug Frame Handling

Technical summary

CVE-2026-10267 is an out-of-bounds read vulnerability in janet-lang's doframe function located in src/core/debug.c. The flaw stems from improper bounds checking when manipulating debug frame structures, allowing an authenticated local attacker to access memory outside allocated buffers. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read), indicating both a buffer management issue and active information disclosure. The CVSS 3.1 score of 3.3 (LOW severity) reflects the local-only attack vector and limited impact scope.

Business impact

Organizations using Janet for local processing, automation, or embedded systems should assess whether this vulnerability affects their deployment posture. While the attack surface is constrained to local users with valid credentials, the information disclosure risk could expose sensitive algorithmic data, cryptographic material, or other memory contents to unauthorized personnel. Development teams relying on Janet's debug facilities should prioritize patching to prevent accidental or malicious information leakage during system administration or debugging workflows.

Affected systems

Janet language runtime versions up to and including 1.41.0 are affected. The vulnerability is present in the debug frame handling mechanism (doframe function), meaning systems actively using Janet's debugging or introspection capabilities are at highest risk. Janet installations without active local user access or those running on restricted, air-gapped systems face reduced practical exposure.

Exploitability

The exploit is publicly available, increasing attack likelihood for those with existing access to vulnerable systems. However, exploitation requires local system access and valid user privileges, substantially limiting the threat scope compared to network-based vulnerabilities. An attacker must authenticate to the system and invoke specific manipulation of debug frame structures to trigger the out-of-bounds read. No user interaction is required once access is obtained.

Remediation

Apply the patch identified by commit hash ed17dd2c5913a23fb1107251e44a9410a3c30cf5. Organizations should verify this commit is included in their deployed Janet version. Consider restricting local system access to trusted administrators and reviewing audit logs for suspicious debug operations on systems running older Janet versions.

Patch guidance

Upgrade Janet to a version containing commit ed17dd2c5913a23fb1107251e44a9410a3c30cf5 (verify against the official janet-lang repository and release notes). Test patched versions in non-production environments before deployment. If an immediate upgrade is not feasible, restrict local user accounts and monitor for anomalous debug frame access patterns.

Detection guidance

Monitor system logs for repeated failed or unusual invocations of Janet debug functions, particularly those involving frame manipulation. Intrusion detection signatures targeting doframe function abuse may be developed by your security team. Review access logs for users executing debug operations outside normal administrative workflows. Consider deploying file integrity monitoring on Janet runtime binaries to detect unauthorized modifications.

Why prioritize this

Despite the LOW CVSS score, prioritization should account for public exploit availability and information disclosure potential in your specific environment. If Janet runs on shared multi-user systems or processes sensitive workloads, treat this as medium priority for patching. For single-user or restricted deployments, lower urgency is acceptable provided access controls are strong.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects a local-only attack vector (AV:L), low attack complexity (AC:L), requirement for low privileges (PR:L), and confidentiality impact (C:L) with no integrity or availability consequences. The score is intentionally conservative due to the multi-factor barriers to exploitation, but the presence of public exploit code and memory disclosure capability warrant practical attention in risk assessments.

Frequently asked questions