CVE-2026-2241: 
NixOS vulnerability analysis and mitigation

CVE-2026-2241 is a heap-buffer-overflow (out-of-bounds read) vulnerability in the os_strftime function of janet-lang/janet, a dynamic scripting language and bytecode VM. It affects all versions of janet up to and including 1.40.1, specifically in src/core/os.c. The vulnerability was discovered and reported on January 23, 2026, via a fuzzer-identified GitHub issue, and publicly disclosed on February 9, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, GitHub Issue).

The root cause is an improper null-terminator check in the os_strftime function (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). When parsing a format string containing a % character at the very end (e.g., "%H:%M:%"), the original code called strchr(valid, *p) without first verifying that *p was not a null byte (\0), causing the pointer to advance past the end of the allocated string buffer and read one byte beyond it. The ASAN report confirmed a READ of size 1 occurring 0 bytes after a 41-byte heap-allocated region at src/core/os.c:1938. Exploitation requires local access with low privileges and no user interaction — an attacker must be able to supply a crafted format string to the os/strftime function (GitHub Issue, Patch Commit).

Successful exploitation primarily causes a denial-of-service condition by crashing the janet runtime process due to the heap-buffer-overflow. There is a limited confidentiality impact, as the out-of-bounds read could theoretically expose one byte of adjacent heap memory, though this is not considered a significant data exfiltration risk. Integrity is not affected. The vulnerability's scope is limited to the local system and does not provide a direct path for lateral movement or remote code execution (Feedly, GitHub Issue).

A proof-of-concept (PoC) exploit — including a reproducer file and a fuzzer harness — has been publicly disclosed on GitHub by the reporter (oneafter) (PoC Repro, GitHub Issue). The vulnerability was discovered via fuzzing and is labeled as a fuzzer-found bug. There is no evidence of in-the-wild exploitation at this time, and it has not been added to the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of active exploitation (Feedly).

1. Identify a target: Locate a system running janet version 1.40.1 or earlier where a local user can execute janet scripts or interact with the janet REPL.
2. Craft a malicious format string: Construct a janet script that calls os/strftime with a format string ending in a bare % character (e.g., (os/strftime "%H:%M:%")).
3. Execute the script: Run the crafted script via the janet interpreter (e.g., janet malicious.janet) or supply it through an embedded janet environment.
4. Trigger the out-of-bounds read: The os_strftime function processes the format string, encounters the trailing % without a following valid specifier or null check, and reads one byte past the end of the allocated heap buffer.
5. Achieve denial of service: The process crashes with a heap-buffer-overflow error (or silently reads adjacent memory in non-ASan builds), causing the janet runtime to abort (GitHub Issue, PoC Repro).

• Process: Unexpected crash or abort of the janet interpreter process; crash dumps referencing os_strftime in src/core/os.c.
• Logs: ASan or sanitizer output containing heap-buffer-overflow at os_strftime /src/core/os.c:1938; application logs showing unhandled exceptions or abrupt termination of janet-based services.
• File System: Presence of fuzzer-generated input files or scripts containing format strings with trailing % passed to os/strftime; core dump files from the janet process.
• Network: No network-based IOCs are expected, as this is a local attack vector (GitHub Issue).

The fix is available as commit 0f285855f0e34f9183956be5f16e045f54626bff in the janet-lang repository, which adds a null-byte check (!*p) before the strchr call in os_strftime and corrects the strftime buffer size argument to use sizeof(buf). Users should upgrade to a version of janet that includes this patch (released after version 1.40.1; the latest release at time of disclosure is 1.41.2). As a workaround, restrict local user access to janet environments and avoid exposing the os/strftime function to untrusted input (Patch Commit, Feedly).