PT-2026-21304 · Wren · Wren

Oneafter · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-2858

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions wren-lang wren versions prior to 0.4.0

Description A flaw exists in wren-lang wren that allows for an out-of-bounds read. This issue is related to the peekChar function within the src/vm/wren compiler.c file, specifically in the Source File Parser component. The attack requires local access. The project was notified of the issue but has not yet responded. The exploit is publicly available.

Recommendations Update to a version of wren-lang wren newer than 0.4.0.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2026-2858

Affected Products

Wren

References · 9

• 🔥 https://github.com/oneafter/0122/blob/main/i1217/repro · Exploit
• https://osv.dev/vulnerability/CVE-2026-2858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2858 · Security Note
• https://github.com/wren-lang/wren/issues/1217 · Note
• https://vuldb.com/?id.347097 · Note
• https://vuldb.com/?ctiid.347097 · Note
• https://vuldb.com/?submit.754489 · Note
• https://github.com/wren-lang/wren · Note
• https://twitter.com/CVEnew/status/2024988745196601437 · Twitter Post