PT-2026-20475 · Wren · Wren

Oneafter · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2657

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wren-lang wren versions prior to 0.4.0

Description A flaw exists in wren-lang wren that relates to a stack-based buffer overflow. This issue is located within the printError function in the src/vm/wren compiler.c file, part of the Error Message Handler component. The vulnerability can be exploited locally. The details of the exploit have been publicly disclosed. The project maintainers were notified of the issue but have not yet responded.

Recommendations Update to a version of wren-lang wren newer than 0.4.0.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-2657

Affected Products

Wren

References · 9

• 🔥 https://github.com/oneafter/0122/blob/main/i1221/repro · Exploit
• https://github.com/wren-lang/wren/issues/1221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2657 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2657 · Vendor Advisory
• https://github.com/wren-lang/wren · Note
• https://twitter.com/CVEnew/status/2024258098698080736 · Twitter Post
• https://vuldb.com/?id.346455 · Note
• https://vuldb.com/?ctiid.346455 · Note
• https://vuldb.com/?submit.752791 · Note