Executive Summary

CVE-2026-3387 is a NULL pointer dereference vulnerability in the Wren programming language compiler, specifically in the function getByteCountForArguments within the source file src/vm/wren_compiler.c.

This vulnerability occurs during the compilation of for loops, especially nested loops or loops inside class methods. The compiler attempts to generate bytecode for the iterator protocol, and due to corrupted internal compiler state—such as malformed class definitions or deeply nested structures—a critical pointer becomes NULL.

When the function tries to access a struct member at an offset from this NULL pointer, it causes a segmentation fault (crash) due to the NULL pointer dereference.

Exploitation requires local access and involves compiling specially crafted Wren scripts that trigger this faulty code path, leading to a crash and potential denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Wren compiler to crash due to a NULL pointer dereference when compiling certain maliciously crafted scripts.

The impact is primarily a denial of service, as the compiler becomes unstable or terminates unexpectedly during compilation.

Since local access is required to exploit this issue, remote exploitation is not possible, limiting the scope of impact.

There is no impact on confidentiality or integrity, but availability of the compiler is affected.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a segmentation fault (NULL pointer dereference) in the Wren compiler when compiling specially crafted Wren scripts containing for loops, especially nested loops or loops inside class methods.

Detection involves attempting to compile suspicious or malformed Wren scripts that might trigger the vulnerability. If the compiler crashes with a segmentation fault during compilation, it indicates the presence of the vulnerability.

A minimal reproduction can be done by running the provided harness program that reads a Wren script and interprets it using the Wren VM. Using a crafted input script that triggers the NULL pointer dereference will cause a crash.

Suggested commands include running the Wren compiler or interpreter on suspicious scripts and monitoring for crashes or segmentation faults. For example, using the harness program with a crafted input file as shown in the public proof-of-concept.

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no official patches or countermeasures have been provided by the Wren project as they have not responded to the issue report.

Immediate mitigation steps include avoiding the use of vulnerable versions of the Wren language compiler (up to version 0.4.0) especially in environments where untrusted or malformed scripts might be compiled.

Consider using alternative products or language versions that are not affected by this vulnerability.

Restrict local access to systems running the Wren compiler to trusted users only, since local access is required to exploit this vulnerability.

Useful 0 Not Useful 0