CVE-2026-10267 Overview
CVE-2026-10267 is an out-of-bounds read vulnerability in the janet-lang janet programming language interpreter, affecting versions up to 1.41.0. The flaw resides in the doframe function within src/core/debug.c. An attacker with local access and low privileges can trigger the condition through crafted input, causing the interpreter to read memory outside the intended buffer boundaries. A public proof-of-concept exists, and the maintainers have committed a fix identified by hash ed17dd2c5913a23fb1107251e44a9410a3c30cf5. The defect is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Local attackers can trigger an out-of-bounds read in the janet interpreter, potentially leaking adjacent process memory or causing the runtime to crash.
Affected Products
- janet-lang janet versions up to and including 1.41.0
- The doframe function in src/core/debug.c
- Applications and scripts embedding the janet interpreter runtime
Discovery Timeline
- 2026-06-01 - CVE CVE-2026-10267 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10267
Vulnerability Analysis
The vulnerability exists in the doframe function of src/core/debug.c in the janet language interpreter. The function handles debug frame processing during interpreter execution. When the function processes frame environment data, it fails to properly validate boundary conditions before reading memory, resulting in an out-of-bounds read condition classified under [CWE-119].
The public PoC published in the GitHub PoC Repository demonstrates triggering the condition through crafted input to the debug subsystem. Exploitation requires local access with low privilege, as reflected by the local attack vector. The impact is limited to confidentiality of memory contents adjacent to the targeted buffer. No integrity or availability impact extends beyond the affected process.
Root Cause
The root cause is improper bounds checking when doframe reads environment data associated with a debug frame. The function dereferences indices into a buffer without validating that the indices remain within allocated memory. This allows an attacker who controls frame data to read bytes beyond the buffer's allocated region.
Attack Vector
Exploitation requires local access to a system running a vulnerable janet interpreter. An attacker submits crafted janet code or input that invokes the debug frame logic, causing doframe to perform the out-of-bounds read. The disclosed PoC at the GitHub PoC Repository documents the trigger pattern. The EPSS score is 0.012%, indicating low predicted exploitation likelihood in the wild.
No verified code examples are available. Refer to the Janet Issue #1743 and the Janet Commit Update for technical details on the trigger and the corrective patch.
Detection Methods for CVE-2026-10267
Indicators of Compromise
- Unexpected crashes or abnormal terminations of processes embedding the janet interpreter, especially when running untrusted scripts.
- Execution of janet scripts originating from untrusted sources that invoke the debug subsystem or doframe-related functionality.
- Presence of janet binaries with versions at or below 1.41.0 on production hosts.
Detection Strategies
- Inventory hosts and developer workstations for janet installations and identify versions at or below 1.41.0.
- Monitor process telemetry for janet interpreter crashes, segmentation faults, or sanitizer alerts indicative of memory access violations.
- Apply software composition analysis to projects embedding janet to flag the vulnerable dependency.
Monitoring Recommendations
- Enable AddressSanitizer or equivalent memory-error detectors in development and CI pipelines that execute janet code.
- Forward host crash logs and core dumps to centralized logging for review when janet processes terminate abnormally.
- Track upstream commits on the Janet Language Repository for additional fixes related to debug subsystem hardening.
How to Mitigate CVE-2026-10267
Immediate Actions Required
- Upgrade janet to a release that includes commit ed17dd2c5913a23fb1107251e44a9410a3c30cf5 or later.
- Restrict execution of untrusted janet scripts on systems where the interpreter is installed.
- Audit applications that embed janet as a scripting engine and verify the embedded version.
Patch Information
The maintainers published a fix in commit ed17dd2c5913a23fb1107251e44a9410a3c30cf5. Review the Janet Commit Update and the discussion in Janet Issue #1743 to confirm patch contents. Rebuild dependent applications against the patched source tree.
Workarounds
- Disable or prevent invocation of the debug subsystem in janet deployments where the patch cannot be applied immediately.
- Limit local user access to systems running the vulnerable janet interpreter to trusted accounts only.
- Run janet processes under reduced operating system privileges to minimize the value of any memory disclosed by the out-of-bounds read.
# Build janet from patched source
git clone https://github.com/janet-lang/janet.git
cd janet
git checkout ed17dd2c5913a23fb1107251e44a9410a3c30cf5
make
sudo make install
janet -v
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
