PT-2026-22289 · Unknown · Berry-Lang

Oneafter · Published 2026-02-27 · Updated 2026-02-27 · CVE-2026-3285

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions berry-lang versions prior to 1.1.1

Description A flaw exists in the scan string function within the src/be lexer.c file of berry-lang. This issue leads to an out-of-bounds read. Local access is required for exploitation. The exploit for this issue has been publicly disclosed.

Recommendations Apply patch 7149c59a39ba44feca261b12f06089f265fec176 to resolve this issue.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2026-3285

Affected Products

Berry-Lang

References · 13

• 🔥 https://github.com/berry-lang/berry/issues/509 · Exploit
• 🔥 https://github.com/oneafter/0211/blob/main/be/repro · Exploit
• https://github.com/berry-lang/berry/commit/7149c59a39ba44feca261b12f06089f265fec176 · Patch
• https://github.com/berry-lang/berry/pull/511 · Patch
• https://osv.dev/vulnerability/CVE-2026-3285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3285 · Security Note
• https://vuldb.com/?id.348014 · Note
• https://twitter.com/VulmonFeeds/status/2027298088667201651 · Twitter Post
• https://twitter.com/CVEnew/status/2027380206508400833 · Twitter Post
• https://t.me/CVEtracker/45928 · Telegram Post
• https://vuldb.com/?ctiid.348014 · Note
• https://vuldb.com/?submit.758872 · Note
• https://github.com/berry-lang/berry · Note