CVE-2026-3383: ChaiScript Divide by Zero Vulnerability

CVE-2026-3383 Overview

A divide by zero vulnerability has been identified in ChaiScript, an embedded scripting language for C++. This weakness affects the function chaiscript::Boxed_Number::go located in the file include/chaiscript/dispatchkit/boxed_number.hpp. By executing a specific manipulation, an attacker with local access can trigger a divide by zero condition, leading to potential denial of service.

Critical Impact

Local attackers can crash applications embedding ChaiScript by triggering a divide by zero exception in the Boxed_Number handling code.

Affected Products

• ChaiScript versions up to and including 6.1.0
• Applications embedding ChaiScript scripting engine
• C++ projects utilizing ChaiScript for embedded scripting functionality

Discovery Timeline

• 2026-03-01 - CVE CVE-2026-3383 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3383

Vulnerability Analysis

This vulnerability is classified as CWE-369 (Divide By Zero), a type of arithmetic exception that occurs when a program attempts to divide a number by zero. The flaw exists within ChaiScript's numeric handling subsystem, specifically in the Boxed_Number::go function.

The vulnerability requires local access to exploit, meaning an attacker would need the ability to execute ChaiScript code within an application that embeds the scripting engine. When triggered, the divide by zero condition can cause the host application to crash or enter an undefined state, resulting in a denial of service condition.

The ChaiScript project was notified of this vulnerability through GitHub Issue #634, however, the maintainers have not yet responded to the report. This lack of response leaves applications using affected versions without an official patch.

Root Cause

The root cause of this vulnerability is improper input validation in the chaiscript::Boxed_Number::go function. The code fails to validate that the divisor operand is non-zero before performing division operations. This missing check allows specially crafted input to pass through to the division operation, triggering an arithmetic exception.

When ChaiScript processes numeric operations through the boxed_number.hpp header, the Boxed_Number class handles type conversions and arithmetic operations. The vulnerable function does not implement adequate bounds checking or zero-value validation before executing division, exposing the underlying application to potential crashes.

Attack Vector

The attack requires local access to the target system with the ability to execute ChaiScript code. An attacker can exploit this vulnerability by providing malicious input that causes a division operation where the divisor evaluates to zero.

The attack can be executed by crafting ChaiScript code that manipulates numeric values through the Boxed_Number interface. When the vulnerable go function processes this input, it attempts the division operation without proper validation, triggering the divide by zero exception.

Technical details regarding the specific exploitation method can be found in the GitHub ChaiScript Issue #634 and the VulDB entry.

Detection Methods for CVE-2026-3383

Indicators of Compromise

• Application crashes with arithmetic exception or SIGFPE signal when processing ChaiScript code
• Error logs showing divide by zero exceptions originating from boxed_number.hpp
• Unexpected termination of services embedding ChaiScript scripting engine

Detection Strategies

• Monitor application logs for arithmetic exceptions and SIGFPE signals from ChaiScript components
• Implement runtime monitoring for abnormal ChaiScript execution patterns
• Use static analysis tools to identify ChaiScript version in use and flag versions <= 6.1.0
• Deploy application-level crash monitoring to detect repeated denial of service attempts

Monitoring Recommendations

• Enable detailed logging for all ChaiScript script execution events
• Set up alerts for application crashes involving the boxed_number.hpp component
• Monitor for unusual patterns of script submissions that may indicate exploitation attempts
• Implement rate limiting on ChaiScript evaluation endpoints to mitigate DoS impact

How to Mitigate CVE-2026-3383

Immediate Actions Required

• Review all applications using ChaiScript and identify those running versions up to 6.1.0
• Implement input validation to filter potentially malicious scripts before ChaiScript evaluation
• Consider isolating ChaiScript execution in sandboxed environments to limit crash impact
• Monitor GitHub ChaiScript Repository for official security updates

Patch Information

As of the last update, no official patch has been released by the ChaiScript maintainers. The project was informed of the vulnerability through GitHub Issue #634 but has not yet responded. Organizations should monitor the official repository for updates and apply patches as soon as they become available.

Workarounds

• Implement wrapper functions that validate divisor operands are non-zero before passing to ChaiScript
• Add try-catch exception handling around ChaiScript evaluation calls to gracefully handle arithmetic exceptions
• Restrict ChaiScript execution to trusted scripts only and disable user-provided script execution where possible
• Consider forking the ChaiScript repository and applying local patches to the Boxed_Number::go function to add zero-value validation