CVE-2026-2655: 
Homebrew vulnerability analysis and mitigation

CVE-2026-2655 is a heap use-after-free vulnerability caused by a race condition in ChaiScript up to and including version 6.1.0. The flaw resides in the chaiscript::str_less::operator() function within include/chaiscript/chaiscript_defines.hpp (line 201). It was reported via a GitHub issue on January 19, 2026, and published to NVD on February 18, 2026. The vulnerability carries a CVSS v3.1 base score of 2.5 (Low), reflecting its local-only, high-complexity attack requirements (Feedly, GitHub Issue).

The root cause is a race condition (CWE-416: Use After Free, CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) between the ChaiScript engine's shutdown sequence and active asynchronous worker threads. When the main thread finishes script execution and begins tearing down the engine, it frees the shared symbol table (std::map). Concurrently, a worker thread spawned via async() continues performing symbol lookups in that same map, causing chaiscript::str_less::operator() to read a std::string key from an already-freed heap region. Exploitation requires a local attacker with low privileges who can supply a crafted ChaiScript file that launches async threads accessing an undefined variable in a tight loop, triggering the race during engine teardown. A public proof-of-concept script is available in the GitHub issue (GitHub Issue).

Successful exploitation results in a heap use-after-free read, causing the ChaiScript interpreter process to crash — a denial-of-service condition. The impact is limited to availability (classified as Low); there is no demonstrated confidentiality or integrity impact. Because the attack is local and requires high complexity, the blast radius is confined to the host running the affected ChaiScript-embedded application, with no evidence of lateral movement potential (Feedly, GitHub Issue).

A proof-of-concept exploit script is publicly available in the ChaiScript GitHub issue tracker, demonstrating the crash via ASAN-instrumented builds on Linux x86_64. The EPSS score is 0.013% (0.000130), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation difficulty is rated high due to the inherent timing requirements of the race condition (GitHub Issue, Feedly).

1. Prepare environment: Obtain local access to a system running a ChaiScript-embedded application using version 6.1.0 or earlier, compiled with threading support.
2. Craft malicious script: Create a ChaiScript file (crash.chai) that launches multiple async threads, each executing a tight loop that references an undefined variable to force repeated symbol table lookups:

var func = fun(){
  var ret = 0;
  for (var i = 0; i < 50000; ++i) {
    re6 += i;
  }
  return ret;
}
var fut1 = async(func);
var fut2 = async(func);

3. Execute the script: Run the ChaiScript interpreter with the crafted file: ./chai crash.chai
4. Race condition triggers: The main thread completes script execution and begins freeing the symbol table (std::map) while worker threads (T1, T2) are still performing lookups for the undefined variable re6 in chaiscript::str_less::operator().
5. Crash achieved: Thread T1 reads a freed std::string key from a deallocated map node, triggering a heap-use-after-free and crashing the process (observable as a segfault or ASAN report) (GitHub Issue).

• Process: Unexpected crash or segmentation fault of a process embedding the ChaiScript interpreter; ASAN output containing heap-use-after-free in chaiscript::str_less::operator() or chaiscript::detail::Dispatch_Engine::get_object.
• Logs: Application crash logs referencing chaiscript_defines.hpp:201 or dispatchkit.hpp:539; core dump files generated by the ChaiScript host process.
• File System: Presence of unexpected .chai script files in accessible directories, particularly those containing async() calls with undefined variable references in loops (GitHub Issue).

The ChaiScript project maintainers have been notified via the GitHub issue but had not responded with an official patch as of the disclosure date; the latest release remains version 6.1.0 (May 2018). Organizations should upgrade to any version of ChaiScript newer than 6.1.0 if and when a patched release becomes available. In the interim, restrict local access to systems running ChaiScript-embedded applications, avoid executing untrusted ChaiScript files, and consider disabling or sandboxing use of the async() function in ChaiScript scripts where possible (GitHub Issue, Feedly).

Red Hat has tracked this vulnerability in their security advisory database, indicating awareness among enterprise Linux vendors. The ChaiScript project maintainers had not publicly responded to the issue report as of the disclosure date. No significant broader media coverage or notable researcher commentary beyond the original GitHub issue report has been identified (Red Hat Advisory, GitHub Issue).