CVE-2026-2656: 
Homebrew vulnerability analysis and mitigation

CVE-2026-2656 is a heap use-after-free vulnerability in ChaiScript up to and including version 6.1.0, triggered by a race condition between the main thread (engine destruction) and a worker thread (exception handling). The flaw resides in the chaiscript::Type_Info::bare_equal function located in include/chaiscript/dispatchkit/type_info.hpp at line 58. It was reported on January 19, 2026 via a GitHub issue and published on February 18, 2026; the ChaiScript project had not responded at time of disclosure (GitHub Issue). It carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 1.1 (Low) (Red Hat CVE).

The root cause is a race condition (CWE-416: Use After Free, CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) between two concurrent threads during ChaiScript engine teardown. When an asynchronous worker thread (T1) throws a chaiscript::exception::eval_error and attempts to format the error message by calling Dispatch_Engine::get_type_name → Type_Info::bare_equal, the main thread (T0) may simultaneously be destroying the Dispatch_Engine and freeing its internal type map (std::_Rb_tree::_M_erase). T1 then reads from a heap region already freed by T0, causing the UAF crash. Exploitation requires local access, low privileges, and high attack complexity to reliably trigger the race window. A public proof-of-concept script is available in the GitHub issue, which launches two async tasks with a deliberate type mismatch (!+i) to trigger the race (GitHub Issue).

Successful exploitation results in a denial-of-service condition via application crash (SIGABRT/DEADLYSIGNAL as reported by AddressSanitizer), with no confidentiality or integrity impact. The availability impact is limited to the local ChaiScript process; there is no evidence of lateral movement potential or data exposure risk. Given the local-only attack vector and low CVSS score, the practical impact is confined to applications embedding ChaiScript that use its async functionality (GitHub Issue, Red Hat CVE).

A proof-of-concept exploit script has been publicly published in the ChaiScript GitHub issue tracker since January 2026 (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.013% (0.000130), indicating very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Red Hat CVE).

1. Setup: Obtain a system with local access where a ChaiScript-embedded application (version ≤ 6.1.0) is running or can be invoked, compiled with or without ASan.
2. Craft the PoC script: Create a ChaiScript file (crash.chai) containing two async tasks that trigger a type mismatch error in a tight loop:

var func = fun(){
  var ret = 0;
  for (var i = 0; i < 50000; !+i) {
    ret += i;
  }
  return ret;
}
var fut1 = async(func);
var fut2 = async(func);
?print(" ${fut1.get()} ${fut2.get()} ")

3. Execute: Run the ChaiScript interpreter against the crafted file: ./chai crash.chai
4. Race condition trigger: The !+i expression causes a type mismatch, triggering eval_error in the worker threads (T1/T2). Simultaneously, the main thread (T0) completes script execution and begins destroying the ChaiScript engine instance, freeing the internal type map.
5. UAF crash: Worker thread T1 calls Dispatch_Engine::get_type_name → Type_Info::bare_equal on a type map node already freed by T0, resulting in a heap-use-after-free and process crash (SIGABRT) (GitHub Issue).

• Process: Unexpected crash or SIGABRT termination of a ChaiScript-embedding application process, particularly when using async() calls.
• Logs: AddressSanitizer output containing heap-use-after-free on address ... in chaiscript::Type_Info::bare_equal or SUMMARY: AddressSanitizer: heap-use-after-free /src/ChaiScript/include/chaiscript/dispatchkit/type_info.hpp:58.
• Logs: Application crash logs referencing chaiscript::detail::Dispatch_Engine::get_type_name or chaiscript::exception::eval_error::format_parameters in stack traces.
• File System: Presence of a ChaiScript script file containing async(func) calls combined with intentional type mismatch expressions (e.g., !+i in a loop) submitted to the interpreter (GitHub Issue).

No official patch has been released by the ChaiScript project as of the disclosure date, and the project had not responded to the issue report (GitHub Issue). Organizations should upgrade beyond version 6.1.0 if and when a patched release becomes available. In the interim, apply the principle of least privilege to restrict local access to systems running ChaiScript-embedded applications, and avoid exposing ChaiScript's async() functionality to untrusted script input. Monitor for unexpected application crashes as a compensating control. Given the low CVSS score and local-only attack vector, this vulnerability can be addressed within regular patching cycles rather than emergency remediation (Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). The ChaiScript project maintainers had not responded to the GitHub issue report at the time of disclosure. No significant broader media coverage or notable researcher commentary beyond the initial bug report has been identified.