CVE-2026-3382: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3382 is a memory corruption vulnerability in ChaiScript affecting all versions up to and including 6.1.0. The flaw resides in the chaiscript::Boxed_Number::get_as function within include/chaiscript/dispatchkit/boxed_number.hpp, triggered via improper handling of Boxed_Value lifetime across threads during asynchronous result interpolation. It was reported via a GitHub issue on January 19, 2026, and publicly disclosed on March 1, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (VulDB, GitHub Issue).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-787 (Out-of-bounds Write), stemming from a thread-safety issue in ChaiScript's Boxed_Number type system. When an asynchronous function result is retrieved via fut.get() and immediately used in string interpolation (e.g., print(" ${fut1.get()} ")), the Boxed_Value returned by the future may reference memory that has already been freed when the worker thread terminated, causing an invalid memory read inside get_as. The attack requires local access and low privileges — an attacker must be able to supply or execute a crafted ChaiScript file. A public proof-of-concept script is available in the GitHub issue report (GitHub Issue, VulDB).

Successful exploitation causes a segmentation fault (SIGSEGV), crashing the host application embedding ChaiScript. The primary impact is availability — the affected process terminates abnormally — with no direct confidentiality or integrity impact identified. Applications that embed ChaiScript and allow untrusted script execution (e.g., game engines, automation tools) are at risk of denial of service through crafted scripts (GitHub Issue, VulDB).

A public proof-of-concept (PoC) ChaiScript file demonstrating the crash was included in the original GitHub issue report and is freely available. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVE status remains "Unknown" per Red Hat's advisory (Red Hat, VulDB).

1. Identify target: Locate an application that embeds ChaiScript ≤ 6.1.0 and allows execution of user-supplied or attacker-controlled .chai script files.
2. Craft malicious script: Create a ChaiScript file that launches asynchronous functions using async() and retrieves their results via fut.get() inside string interpolation:

var func = fun(){
    var ret = 0;
    for (var i = 0; i < 50000; ++i) { ret := i; }
    return ret;
}
var &fut1 = async(func);
var fut2 = async(func);
print(" ${fut1.get()} ${fut2.get()} ")

3. Trigger execution: Supply the crafted script to the target application (e.g., via a script file argument, plugin system, or scripting interface).
4. Achieve denial of service: The race condition between thread termination and Boxed_Number::get_as accessing freed memory causes a SIGSEGV, crashing the host process (GitHub Issue).

• Process: Host application process (embedding ChaiScript) terminates unexpectedly with a segmentation fault (signal 11 / SIGSEGV).
• Logs: Crash reports or core dumps referencing chaiscript::Boxed_Number::get_as in the stack trace; ASAN output showing SEGV on unknown address within boxed_number.hpp.
• File System: Presence of unexpected .chai script files in application directories, particularly those containing async() calls combined with string interpolation of future results.
• Process: Unusual spawning of multiple threads by the ChaiScript-embedding application followed by abrupt process termination (GitHub Issue).

No official patch has been released by the ChaiScript project as of the disclosure date, and the maintainers had not responded to the issue report at time of publication. As a workaround, applications embedding ChaiScript should restrict or sandbox execution of untrusted scripts, and avoid exposing the async() function to untrusted users. Organizations should monitor the ChaiScript GitHub repository for future patches and consider pinning to a patched version once available (Red Hat, GitHub Issue).

Red Hat has acknowledged the vulnerability and published a CVE advisory page, though no specific Red Hat products are listed as affected. The ChaiScript project maintainers had not responded to the GitHub issue report as of the disclosure date. Coverage has been limited to automated vulnerability aggregators (VulDB, Vulners, CIRCL, ENISA EUVD) with no notable independent researcher commentary or significant social media discussion observed (Red Hat, GitHub Issue).