CVE-2026-2858
Out-of-Bounds Read in wren-lang peekChar Function
Publication date: 2026-02-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wren | wren | to 0.4.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the wren-lang wren project up to version 0.4.0, specifically in the function peekChar within the source file src/vm/wren_compiler.c, which is part of the Source File Parser component.
The issue allows for an out-of-bounds read due to improper handling in the peekChar function. This means that the program may read memory outside the intended boundaries, potentially exposing unintended data.
The attack exploiting this vulnerability must be performed locally, and an exploit is publicly available. The project was informed early but has not yet responded.
How can this vulnerability impact me? :
The vulnerability leads to an out-of-bounds read, which can cause the application to access memory it should not, potentially leading to information disclosure or application instability.
Since the attack requires local access and the impact is limited to availability (as per CVSS scores), the risk is relatively low but could still result in partial denial of service or exposure of sensitive memory contents.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know