CVE-2026-2241: janet-lang janet Buffer Overflow Vulnerability

CVE-2026-2241 Overview

An out-of-bounds read vulnerability has been identified in janet-lang janet versions up to 1.40.1. This vulnerability affects the os_strftime function located in the file src/core/os.c. When exploited, an attacker can manipulate inputs to trigger an out-of-bounds read condition, potentially leading to information disclosure or application crashes.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to read memory beyond intended boundaries, potentially exposing sensitive information or causing denial of service through application instability.

Affected Products

• janet-lang janet versions up to and including 1.40.1
• Applications and systems utilizing vulnerable janet-lang janet builds
• Development environments with unpatched janet interpreters

Discovery Timeline

• 2026-02-09 - CVE-2026-2241 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2241

Vulnerability Analysis

This vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The os_strftime function in src/core/os.c fails to properly validate input boundaries before performing memory operations. When crafted input is provided to this function, it can read data beyond the allocated buffer boundaries.

The local attack vector requires an attacker to have some level of access to the system where janet is running. The vulnerability does not directly impact confidentiality or integrity but can affect system availability. A proof-of-concept exploit has been made publicly available, increasing the likelihood of exploitation attempts.

Root Cause

The root cause of this vulnerability lies in insufficient bounds checking within the os_strftime function. The function processes time formatting strings without adequately validating the size of input data against buffer boundaries. This oversight allows specially crafted inputs to cause the function to read memory locations outside the intended buffer range.

Attack Vector

The attack requires local access to the system running a vulnerable version of janet-lang janet. An attacker with low-level privileges can craft malicious input that, when processed by the os_strftime function, triggers the out-of-bounds read condition.

The vulnerability manifests when manipulated format strings or time data are passed to the os_strftime function. The function fails to properly validate memory boundaries during its operations, leading to reads beyond the allocated buffer. For technical details and proof-of-concept reproduction steps, refer to GitHub Issue #1701 and the PoC repository.

Detection Methods for CVE-2026-2241

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using janet-lang janet
• Abnormal memory access patterns or errors logged by janet-based applications
• Suspicious local activity targeting janet interpreter processes

Detection Strategies

• Monitor for crashes or error logs related to the os_strftime function in janet applications
• Implement memory sanitizers (ASan, MSan) in development and testing environments to detect out-of-bounds reads
• Review application logs for unusual time formatting operations or related function calls

Monitoring Recommendations

• Enable detailed logging for janet-based applications to capture function-level errors
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to identify memory exploitation attempts
• Regularly audit systems running janet-lang for versions affected by this vulnerability

How to Mitigate CVE-2026-2241

Immediate Actions Required

• Update janet-lang janet to a version containing the security patch (commit 0f285855f0e34f9183956be5f16e045f54626bff or later)
• Review and restrict local access to systems running janet applications
• Implement input validation for any external data processed by janet scripts
• Consider temporarily disabling time formatting functionality if immediate patching is not possible

Patch Information

A patch has been released by the janet-lang project to address this vulnerability. The fix is available in commit 0f285855f0e34f9183956be5f16e045f54626bff. Users should update to a version of janet-lang janet that includes this commit. Additional details about the issue and its resolution can be found in GitHub Issue #1701.

Workarounds

• Restrict local user access to systems running vulnerable janet versions until patching is complete
• Implement application-level input validation to sanitize data before it reaches the os_strftime function
• Use containerization or sandboxing to limit the impact of potential exploitation
• Monitor and audit any janet scripts that utilize time formatting functionality

# Configuration example - Update janet to patched version
git clone https://github.com/janet-lang/janet.git
cd janet
git checkout 0f285855f0e34f9183956be5f16e045f54626bff
make
sudo make install