CVE-2026-2240: 
NixOS vulnerability analysis and mitigation

CVE-2026-2240 is a heap-buffer out-of-bounds read vulnerability in the janetc_pop_funcdef function within src/core/compile.c of the janet-lang Janet programming language runtime. It affects all versions of Janet up to and including 1.40.1. The vulnerability was discovered via fuzzing and reported on January 23, 2026, with public disclosure occurring on February 9, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, GitHub Issue).

The root cause is a size mismatch between the closure bitset buffer allocated via calloc at compile.c:959 and the index used to access it at compile.c:965, classified as CWE-125 (Out-of-bounds Read) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Specifically, the compiler creates many upvalue slots without using them, and faulty logic uses the wrong length to check the bitmap's bounds — the buffer may be allocated as only 4 bytes, but the code attempts to read 24 bytes past the end of that region (e.g., accessing index 7 of a single-element array). The attack requires local access and low privileges; an attacker crafts a Janet source file with a large number of upvalue declarations (more than 224) that triggers the compiler's linting phase (janet_compile_lint). A public proof-of-concept reproducer file and harness code are available (GitHub Issue, GitHub Commit, PoC Repro).

Successful exploitation causes the Janet runtime to crash due to an invalid heap memory read, resulting in a denial of service (application termination). There is a low confidentiality impact, as out-of-bounds reads can potentially expose adjacent heap memory contents. Integrity is not affected. The vulnerability is limited to local attack scenarios and does not directly enable remote code execution or lateral movement, but could disrupt services or scripts that embed Janet as a scripting engine (Feedly, GitHub Issue).

A public proof-of-concept exploit (reproducer file) was disclosed alongside the bug report and is available on GitHub (PoC Repro, GitHub Issue). The vulnerability was discovered through fuzzing (labeled with the fuzz tag in the issue tracker). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Prepare the environment: Obtain a vulnerable version of Janet (≤ 1.40.1) and compile it, optionally with ASan enabled to observe the crash clearly.
2. Craft a malicious Janet source file: Create a Janet script that generates more than 224 upvalue slots in a single function scope. The public PoC demonstrates this using a pattern like (each item [1 2 3] (def ;;;;...;;;;out-buf @"") (with-dyns [:out out-buf] 1)) with a large number of semicolons (splat operators) to force many upvalue allocations (GitHub Issue).
3. Trigger compilation: Pass the crafted file to the Janet runtime or an embedding harness that calls janet_dostring or janet_dobytes, which invokes janet_compile → janet_compile_lint → janetc_pop_funcdef.
4. Observe crash: The janetc_pop_funcdef function allocates a closure bitset buffer sized for only 1 chunk (4 bytes) but then attempts to access index 7 (28 bytes offset), reading 24 bytes past the end of the allocation, triggering an ASan heap-buffer-overflow or a segmentation fault in non-instrumented builds (GitHub Issue, PoC Repro).

• Process: Unexpected crash or abort of the janet process or any application embedding the Janet runtime, particularly when processing untrusted Janet source files.
• Logs: ASan reports containing heap-buffer-overflow in janetc_pop_funcdef at src/core/compile.c:965; crash logs referencing janet_compile_lint or janet_dobytes in the stack trace.
• File System: Presence of suspicious Janet source files containing an unusually large number of upvalue declarations (e.g., hundreds of semicolons/splat operators in a def form) in directories processed by the Janet runtime.
• Core Dumps: Core dump files generated by the Janet process, potentially containing heap memory contents adjacent to the out-of-bounds read location (GitHub Issue).

Apply the upstream patch commit 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5, which adds an extra bounds check in janetc_pop_funcdef to ensure that slotchunks > 7 before accessing chunks[7], preventing the out-of-bounds read (GitHub Commit). Users should upgrade to a Janet release that includes this commit (versions after 1.40.1). As a workaround where upgrading is not immediately possible, restrict local user access to systems running vulnerable Janet versions and avoid processing untrusted Janet source files.