CVE-2026-10268: janet-lang Integer Overflow Vulnerability

CVE-2026-10268 Overview

CVE-2026-10268 is an integer overflow vulnerability in the janet-lang janet interpreter through version 1.41.0. The flaw resides in the unmarshal_one_fiber function inside src/core/marsh.c, where arithmetic on a fiber stack value can wrap past INT32_MAX. A local attacker with low privileges can trigger the overflow by supplying a crafted marshalled input to the unmarshal routine. A public proof-of-concept exists, and the maintainers have published commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d to remediate the issue. The weakness is classified under [CWE-189] (Numeric Errors).

Critical Impact
Local exploitation of the integer overflow can corrupt fiber capacity calculations during unmarshalling, leading to undefined behavior and potential availability impact in applications that deserialize untrusted Janet data.

Affected Products

janet-lang janet up to and including version 1.41.0
The unmarshal_one_fiber function in src/core/marsh.c
Applications embedding the Janet interpreter that unmarshal untrusted input

Discovery Timeline

2026-06-01 - CVE-2026-10268 published to the National Vulnerability Database (NVD)
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10268

Vulnerability Analysis

The vulnerability is an integer overflow in unmarshal_one_fiber, a routine that reconstructs Janet fiber objects from a marshalled byte stream. The function reads a fiber_stacktop value from attacker-influenced input and then computes fiber_stacktop + 10 to size the new fiber capacity. When fiber_stacktop is close to INT32_MAX, the addition wraps to a negative or unexpectedly small value. That tainted result is then used in janet_malloc(sizeof(Janet) * fiber->capacity), undermining the assumptions of the surrounding code. The attack vector is local and requires a process to unmarshal untrusted serialized data, such as Janet programs accepting external state files or IPC payloads.

Root Cause

The root cause is the absence of a bounds check before the addition fiber_stacktop + 10. The original code trusts the unmarshalled fiber_stacktop value without verifying that the sum fits within a 32-bit signed integer.

Attack Vector

An attacker delivers a crafted marshalled blob to a Janet process that invokes the unmarshal path. Local access and low privileges are sufficient, with no user interaction required. The result is an arithmetic anomaly during fiber allocation, affecting availability of the host process.

     }
 
     /* Allocate stack memory */
-    fiber->capacity = fiber_stacktop + 10;
+    if (fiber_stacktop < INT32_MAX - 10) {
+        fiber->capacity = fiber_stacktop + 10;
+    } else {
+        /* Extra capacity is usually nice to avoid immediately reallocing on pushed arguments, but not needed */
+        fiber->capacity = INT32_MAX;
+    }
     fiber->data = janet_malloc(sizeof(Janet) * fiber->capacity);
     if (!fiber->data) {
         JANET_OUT_OF_MEMORY;

Source: GitHub Commit d9b1d711 — The patch clamps fiber->capacity to INT32_MAX whenever adding 10 would overflow, eliminating the wraparound.

Detection Methods for CVE-2026-10268

Indicators of Compromise

Unexpected crashes or aborts in processes that invoke Janet's unmarshal routines on external input.
Presence of janet binaries with versions at or below 1.41.0 on production hosts.
Local file artifacts matching the public proof-of-concept payload published at the janet-marsh-unmarshal-intovf PoC repository.

Detection Strategies

Inventory all hosts and containers running Janet 1.41.0 or earlier and flag them for patch verification.
Hunt for processes that read marshalled Janet payloads from world-writable paths, sockets, or shared memory.
Monitor crash telemetry for repeated faults originating in marsh.c or related fiber allocation paths.

Monitoring Recommendations

Enable core dump collection on Janet-embedding applications and forward stack traces to a central log store for triage.
Track unusual janet_malloc failure patterns or JANET_OUT_OF_MEMORY log entries that may indicate exploitation attempts.
Alert on execution of janet processes from non-standard directories or by unprivileged service accounts.

How to Mitigate CVE-2026-10268

Immediate Actions Required

Apply commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d from the Janet upstream repository and rebuild affected binaries.
Restrict the sources of marshalled Janet input to trusted, authenticated producers only.
Audit embedded applications for code paths that pass untrusted bytes to janet_unmarshal or equivalent APIs.

Patch Information

The upstream fix is delivered in commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d referenced in janet-lang issue #1744. The patch adds a guard ensuring fiber_stacktop is less than INT32_MAX - 10 before computing fiber->capacity, and otherwise clamps capacity to INT32_MAX. Downstream distributors should rebuild from a commit that includes this change or a later release.

Workarounds

Do not unmarshal Janet data originating from untrusted users, files, or network endpoints until the patch is deployed.
Run Janet workloads under reduced OS privileges and resource limits to constrain impact of a local overflow.
Where possible, isolate Janet interpreters in sandboxed containers with read-only inputs and limited memory budgets.

bash

# Build patched Janet from source
git clone https://github.com/janet-lang/janet.git
cd janet
git checkout d9b1d711ea1fde52ac73a82088b512a3e17bad0d
make
sudo make install
janet -v