CVE-2026-3386

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A flaw has been found in wren-lang wren up to 0.4.0. Affected by this vulnerability is the function emitOp of the file src/vm/wren_compiler.c. This manipulation causes out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119 CWE-125

Affected software

Vendor	Product	Versions
wren-lang	wren	0.1; 0.2; 0.3; 0.4.0

References

https://github.com/oneafter/0122/blob/main/i1219/reproExploit
https://github.com/wren-lang/wren/Product
https://github.com/wren-lang/wren/issues/1219Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.348272Permissions Required, VDB Entry
https://vuldb.com/?id.348272Third Party Advisory, VDB Entry
https://vuldb.com/?submit.761306Third Party Advisory, VDB Entry

Timeline

Published: Mar 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-338626.1A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), Teamcente CVE-2026-338655.4MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An CVE-2026-338664.3MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑co CVE-2026-338677.5WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individ CVE-2026-338686.1Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated CVE-2026-338694.8Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x CVE-2026-33875.5A vulnerability has been found in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file sr CVE-2026-338707.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly CVE-2026-338717.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can CVE-2026-338727.1elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Le CVE-2026-338739.9Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Lang CVE-2026-338747.8Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version