Service crash via overflowing fiber capacity allocation
Published Jun 1, 2026 · Updated Jun 1, 2026
Integer overflow in Janet 1.41.0 and earlier allows local users to crash the interpreter via crafted marshalled fiber data. The unmarshal_one_fiber routine adds 10 to an attacker-controlled fiber_stacktop of up to INT32_MAX, then uses the wrapped capacity to size a heap allocation. Exploitation requires a Janet program to unmarshal crafted data; 64-bit builds abort on an oversized allocation, while 32-bit builds can corrupt the heap.
Summary
What happened
Integer overflow in Janet 1.41.0 and earlier allows local users to crash the interpreter via crafted marshalled fiber data. The unmarshal_one_fiber routine adds 10 to an attacker-controlled fiber_stacktop of up to INT32_MAX, then uses the wrapped capacity to size a heap allocation. Exploitation requires a Janet program to unmarshal crafted data; 64-bit builds abort on an oversized allocation, while 32-bit builds can corrupt the heap.
The record
- CVE
- CVE-2026-10268
- Published
- Jun 1, 2026
- Updated
- Jun 1, 2026
- Vendor
- Janet Language
- Product
- Janet
- Classifications
- CWE-189, CWE-190
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Jun 1, 2026CVE publishedPublication date reported by the CVE source.
- Jun 1, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=1.0
- Affected versionversion=1.1
- Affected versionversion=1.10
- Affected versionversion=1.11
- Affected versionversion=1.12
- Affected versionversion=1.13
- Affected versionversion=1.14
- Affected versionversion=1.15
- Affected versionversion=1.16
- Affected versionversion=1.17
- Affected versionversion=1.18
- Affected versionversion=1.19
- Affected versionversion=1.2
- Affected versionversion=1.20
- Affected versionversion=1.21
- Affected versionversion=1.22
- Affected versionversion=1.23
- Affected versionversion=1.24
- Affected versionversion=1.25
- Affected versionversion=1.26
- Affected versionversion=1.27
- Affected versionversion=1.28
- Affected versionversion=1.29
- Affected versionversion=1.3
- Affected versionversion=1.30
- Affected versionversion=1.31
- Affected versionversion=1.32
- Affected versionversion=1.33
- Affected versionversion=1.34
- Affected versionversion=1.35
- Affected versionversion=1.36
- Affected versionversion=1.37
- Affected versionversion=1.38
- Affected versionversion=1.39
- Affected versionversion=1.4
- Affected versionversion=1.40
- Affected versionversion=1.41.0
- Affected versionversion=1.5
- Affected versionversion=1.6
- Affected versionversion=1.7
- Affected versionversion=1.8
- Affected versionversion=1.9
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- Janet marshalled-fiber integer-overflow PoCproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo