PT-2026-22501 · Unknown · Chaiscript

Oneafter · Publicado 2026-03-01 · Atualizado 2026-03-05 · CVE-2026-3382

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ChaiScript versions up to 6.1.0

Description A security flaw exists in ChaiScript that can lead to memory corruption. The issue is located in the get as function within the chaiscript::Boxed Number class, specifically in the include/chaiscript/dispatchkit/boxed number.hpp file. Exploitation requires local access. The exploit is publicly available. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to 6.1.0 should be updated. As a temporary workaround, consider avoiding the use of the get as function until a patch is available.

Exploit

Correção

Memory Corruption

Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-119

Identificadores relacionados

CVE-2026-3382

Produtos afetados

Chaiscript

Referências · 13

• 🔥 https://github.com/ChaiScript/ChaiScript/issues/635#issue-3828258513 · Exploit
• https://github.com/ChaiScript/ChaiScript/issues/635 · Nota
• https://vuldb.com/?ctiid.348268 · Nota
• https://t.me/cveNotify/154423 · Publicação no Telegram
• https://github.com/ChaiScript/ChaiScript · Nota
• https://t.me/CVEtracker/46056 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3382 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2027993463598260249 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3382 · Nota de Segurança
• https://t.me/cveNotify/153659 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2027997204057637089 · Publicação no Twitter
• https://vuldb.com/?id.348268 · Nota
• https://vuldb.com/?submit.761301 · Nota