CVE-2026-3285

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in berry-lang berry up to 1.1.0. The affected element is the function scan_string of the file src/be_lexer.c. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Patch name: 7149c59a39ba44feca261b12f06089f265fec176. Applying a patch is the recommended action to fix this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
berry-lang	berry	1.0; 1.1.0

References

https://github.com/berry-lang/berry/Product
https://github.com/berry-lang/berry/commit/7149c59a39ba44feca261b12f06089f265fec176Patch
https://github.com/berry-lang/berry/issues/509Exploit, Issue Tracking
https://github.com/berry-lang/berry/pull/511Issue Tracking
https://github.com/oneafter/0211/blob/main/be/reproExploit
https://vuldb.com/?ctiid.348014Permissions Required, VDB Entry
https://vuldb.com/?id.348014Third Party Advisory, VDB Entry
https://vuldb.com/?submit.758872Third Party Advisory, VDB Entry

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-328506.1MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attack CVE-2026-328516.1MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attack CVE-2026-328526.1MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attack CVE-2026-328538.1LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding ha CVE-2026-328547.5LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers CVE-2026-328566.1Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerability that allows un CVE-2026-328578.6Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping se CVE-2026-328595.4ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows att CVE-2026-32864.3A vulnerability was identified in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3. The impacted element is the function Save of the file paicodin CVE-2026-328607.8There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW. This vulnerabil CVE-2026-328617.8There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW. This vulnerab CVE-2026-328627.8There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW. This vulnerabi