CVE-2026-3285: 
NixOS vulnerability analysis and mitigation

CVE-2026-3285 is a global-buffer-overflow (out-of-bounds read) vulnerability in the scan_string function of src/be_lexer.c in berry-lang/berry, an ultra-lightweight embedded scripting language designed for microcontrollers. It affects berry versions up to and including 1.1.0. The vulnerability was reported on February 11, 2026, publicly disclosed on February 27, 2026, and patched on March 4, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 1.9 (Low), reflecting the local-only attack vector (Red Hat CVE, Feedly).

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-125). Specifically, in src/be_lexer.c, the scan_string function calls save() to store a backslash character when it encounters a \ escape sequence, but then immediately calls next() (via lgetc) to read the following character without first checking for end-of-string (EOS). When a crafted script places a backslash at the very end of input, the subsequent read goes one byte past the static eos buffer, triggering a global-buffer-overflow of size 1 at be_lexer.c:111. The fix (commit 7149c59) adds an EOS check immediately after saving the backslash, breaking out of the loop and reporting an "unfinished string" error instead (GitHub Issue #509, GitHub PR #511, Patch Commit). A minimal proof-of-concept reproducer ("\\) is publicly available (PoC Repo).

An attacker with local access and low privileges can supply a specially crafted Berry script to trigger an out-of-bounds read in the lexer, potentially leaking one or more bytes of adjacent memory. In embedded or IoT contexts where berry is used (e.g., Tasmota firmware), this could expose sensitive runtime data. While integrity and availability are not directly impacted by the read itself, the invalid memory access can also cause the interpreter to abort, resulting in a denial-of-service for the hosting application (GitHub Issue #509, Feedly).

A public proof-of-concept exploit (a four-byte Berry script: "\\) was disclosed alongside the bug report and is hosted on GitHub (PoC Repo). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of near-term exploitation. Exploitation requires local access and low privileges, significantly limiting the attack surface (Feedly, GitHub Issue #509).

1. Obtain local access: Gain local or shell access to a system running a vulnerable version of berry (≤ 1.1.0), or identify an application (e.g., Tasmota-based IoT device) that accepts user-supplied Berry scripts.
2. Create the malicious script: Craft a Berry source file containing a string literal with a trailing backslash at end-of-input. The minimal reproducer is a file containing exactly: "\\ (four bytes: double-quote, backslash, backslash, end-of-file) (PoC Repo).
3. Execute the script: Run the berry interpreter against the crafted file: ./berry repro. The lexer's scan_string function will save the backslash and then call next()/lgetc() without an EOS check, reading one byte past the static eos buffer.
4. Observe the out-of-bounds read: Under AddressSanitizer or similar tooling, the global-buffer-overflow is confirmed at be_lexer.c:111. In production builds, the adjacent memory byte is read and may be incorporated into the parsed token, potentially leaking memory content or causing an interpreter crash (GitHub Issue #509).

• File System: Presence of unexpected .be script files containing string literals ending with a bare backslash (e.g., "\ at end-of-file) in directories accessible to the berry interpreter.
• Process: Abnormal termination (abort/crash) of the berry interpreter process or any embedding application (e.g., Tasmota) with a signal such as SIGABRT, particularly when processing user-supplied scripts.
• Logs: Application or system logs showing berry interpreter crashes or "unfinished string" parse errors when processing externally supplied scripts; ASan reports referencing be_lexer.c:111 in development/debug environments.

Apply the patch introduced in commit 7149c59a39ba44feca261b12f06089f265fec176, merged into the berry-lang/berry master branch on March 4, 2026 via PR #511 (Patch Commit, GitHub PR #511). Users of downstream projects such as Tasmota should monitor for a release incorporating this fix (tracked in arendst/Tasmota#24653). As a workaround where patching is not immediately possible, restrict local access to systems running berry and avoid executing untrusted Berry scripts.

The vulnerability was reported by researcher "oneafter" directly to the berry-lang project via GitHub Issue #509 on February 11, 2026, and was promptly addressed by contributor s-hadinger in PR #511, merged March 4, 2026 (GitHub Issue #509, GitHub PR #511). The fix was also noted in the Tasmota project, which embeds berry, indicating awareness in the IoT firmware community. No significant broader media coverage or notable social media discussion beyond the GitHub thread and automated CVE aggregators has been observed.