CVE-2026-2858

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the component Source File Parser. Such manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Feb 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-285807.8In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of prCVE-2026-285814.0In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the cCVE-2026-285823.3In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due tCVE-2026-285837.8In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. ThisCVE-2026-285845.5In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the CVE-2026-285863.3In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to loCVE-2026-285875.5In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This CVE-2026-28594.3Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated useCVE-2026-285907.8In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escCVE-2026-285937.8In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead tCVE-2026-285947.8In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilegeCVE-2026-285965.5In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This cou
CVE-2026-2858: High severity, CVSS 7.1 | Vulnix