CVE-2026-2241
Out-of-Bounds Read in janet-lang os_strftime Function
Publication date: 2026-02-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| janet-lang | janet | to 1.40.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the janet-lang janet software up to version 1.40.1, specifically in the function os_strftime located in the file src/core/os.c.
It involves an out-of-bounds read caused by manipulation of the function's input or behavior.
The attack must be performed locally, meaning the attacker needs local access to the system to exploit this issue.
A patch has been released to fix this vulnerability.
How can this vulnerability impact me? :
The vulnerability allows an out-of-bounds read which can potentially lead to a denial of service or other unexpected behavior.
Since the attack requires local access and the CVSS scores are low (BaseScore 1.7 to 3.3 depending on version), the impact is limited.
There is no indication of confidentiality or integrity loss, but availability could be affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, it is recommended to deploy the patch named 0f285855f0e34f9183956be5f16e045f54626bff.
Since the attack must be initiated from a local position, limiting local access to trusted users can also reduce risk.