Description
A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.
References (9)
Core 9
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-367546 | janet-lang janet debug.c doframe out-of-bounds
https://vuldb.com/vuln/367546
Signature, Permissions Required signature
permissions-required
VDB-367546 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/367546/cti
Third Party Advisory third-party-advisory
CVE-2026-10267 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10267
Third Party Advisory third-party-advisory
Submit #825072 | janet-lang janet 1.41.0 Out-of-Bounds Read
https://vuldb.com/submit/825072
Issue Tracking issue-tracking
https://github.com/janet-lang/janet/issues/1743
Issue Tracking issue-tracking
https://github.com/janet-lang/janet/issues/1743#issuecomment-4322129448
Exploit exploit
https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oobread
Product product
https://github.com/janet-lang/janet/
Scores
CVSS v3
3.3
EPSS
0.0012
EPSS Percentile
2.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-119
CWE-125
Status
published
Products (42)
janet-lang/janet
1.0
janet-lang/janet
1.1
janet-lang/janet
1.10
janet-lang/janet
1.11
janet-lang/janet
1.12
janet-lang/janet
1.13
janet-lang/janet
1.14
janet-lang/janet
1.15
janet-lang/janet
1.16
janet-lang/janet
1.17
... and 32 more
Published
Jun 01, 2026
Tracked Since
Jun 01, 2026