What’s Vulnerable › Vulnerabilities

CVE-2026-10267: janet-lang janet debug.c doframe out-of-bounds

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-119

Description

A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.

Affected products

• janet-lang janet: 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+36)

References

• https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oobread
• https://github.com/janet-lang/janet/
• https://github.com/janet-lang/janet/commit/ed17dd2c5913a23fb1107251e44a9410a3c30cf5
• https://github.com/janet-lang/janet/issues/1743
• https://github.com/janet-lang/janet/issues/1743#issuecomment-4322129448
• https://vuldb.com/cve/CVE-2026-10267
• https://vuldb.com/submit/825072
• https://vuldb.com/vuln/367546
• https://vuldb.com/vuln/367546/cti

Get alerted when CVE-2026-10267 or the next vulnerability affects your stack