CVE-2026-10268: Janet Language Integer Overflow in Fiber Deserialization

Technical summary

CVE-2026-10268 is an integer overflow vulnerability in the unmarshal_one_fiber function within src/core/marsh.c of Janet language up to version 1.41.0. The vulnerability stems from improper validation of integer values during deserialization of fiber objects. Exploitation requires local access and low privileges. The flaw maps to CWE-189 (Numeric Errors) and CWE-190 (Integer Overflow or Wraparound), indicating insufficient bounds checking during marshal/unmarshal operations. A public exploit is available, though the low CVSS score reflects the attack's local-only nature and limited impact scope.

Business impact

This vulnerability primarily affects availability rather than confidentiality or integrity. Organizations running Janet-based applications in multi-tenant or shared-access environments face localized denial-of-service risk. The impact is contained to the affected process—an integer overflow causes application crashes rather than system-wide compromise. However, applications relying on Janet for compute-intensive or mission-critical operations should prioritize patching to maintain uptime and prevent attackers from forcing service interruptions through serialized data manipulation.

Affected systems

Janet language runtime installations version 1.41.0 and earlier are vulnerable. The affected code path is triggered only when deserializing fiber objects from untrusted or attacker-controlled marshaled data. Applications using Janet's serialization features (particularly those accepting external serialized inputs) face the highest risk. Environments where only trusted users can provide inputs have significantly reduced exposure.

Exploitability

The vulnerability requires local system access and can be exploited by unprivileged users. A public exploit is available, lowering the barrier to weaponization. However, practical exploitation is limited to scenarios where an attacker can either place malicious serialized data where an application will deserialize it, or interact directly with a Janet process. Remote exploitation is not possible through this vector alone—it would require chaining with another remote code execution or file upload vulnerability to deliver the malicious payload.

Remediation

Apply the patch identified as commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d or update to a Janet version released after this fix. Verify the patch against the official Janet language repository and release notes to confirm the version incorporates this commit. Organizations should prioritize systems where untrusted users have local access or where applications deserialize external fiber data.

Patch guidance

Update Janet language to a version that includes commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d. Consult the official Janet repository and release notes to identify the first stable release containing this fix. Test patched versions in non-production environments to ensure compatibility with deployed Janet applications before rolling out to production. If you cannot patch immediately, implement input validation and sanitization for any serialized data before passing it to unmarshal operations.

Detection guidance

Monitor for application crashes or segmentation faults in Janet processes, particularly those handling serialized data. Log analysis of applications using Janet's marshaling functions may reveal patterns of malformed input attempts. Network-level detection is limited since the attack is local; focus detection efforts on system-level indicators such as unexpected process terminations, core dumps, or repeated crashes in Janet runtimes following suspicious file access or IPC activity. Consider deploying application-level logging to track deserialization failures.

Why prioritize this

Although the CVSS score is low (3.3), this vulnerability should not be deprioritized indefinitely. The availability of a public exploit and the relative ease of local exploitation make it suitable for inclusion in routine patch management cycles. Prioritize patching in systems with multi-user access, containerized Janet applications, or those deserializing untrusted data. For isolated systems or those with strict access controls, this can be scheduled during standard maintenance windows without emergency treatment.

Risk score, explained

The CVSS v3.1 score of 3.3 (LOW) reflects the attack vector (Local only), low privileges required, and impact limited to availability denial. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates no confidentiality or integrity impact. The score appropriately captures that this is a local denial-of-service issue with no data breach risk. However, organizations should consider business context—if Janet availability is critical to operations, local DoS may warrant faster remediation despite the low base score.

Frequently asked questions