CVE-2026-3383: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3383 is a Divide By Zero vulnerability in ChaiScript, an embedded scripting language designed for C++. The flaw exists in the chaiscript::Boxed_Number::go function within include/chaiscript/dispatchkit/boxed_number.hpp (line 236), where integer modulo or division operations are performed without checking for a zero divisor. All versions of ChaiScript up to and including 6.1.0 are affected. The vulnerability was reported via a GitHub issue on January 19, 2026, and published to NVD on March 1, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (VulDB, Red Hat CVE).

The root cause is classified as CWE-369 (Divide By Zero). The Boxed_Number implementation in boxed_number.hpp performs arithmetic operations — specifically modulo (% and %=) — directly on integer operands without validating that the right-hand divisor is non-zero. On x86/x64 systems, integer modulo by zero triggers a hardware SIGFPE (Floating Point Exception), causing the process to crash. Exploitation requires local access and low privileges; an attacker must be able to supply a crafted ChaiScript file or string to the interpreter. A public proof-of-concept script is available that triggers the crash via a loop starting at i = 0 and immediately performing ret %= i (GitHub Issue #634).

Successful exploitation results in a process crash (SIGFPE/abort), causing a denial of service for any application embedding the ChaiScript interpreter. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Applications that use ChaiScript to evaluate user-supplied or untrusted scripts are most at risk, as a malicious script can reliably crash the host process (VulDB, GitHub Issue #634).

A public proof-of-concept exploit script has been disclosed and is referenced in the VulDB entry and the GitHub issue report. The EPSS score is approximately 0.005% (0.000050), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The ChaiScript project had not responded to the issue report as of the time of disclosure (VulDB, GitHub Issue #634).

1. Identify target: Locate an application that embeds ChaiScript version ≤ 6.1.0 and accepts user-supplied or file-based ChaiScript input for evaluation.
2. Craft malicious script: Create a ChaiScript file (crash.chai) containing a function that performs modulo by zero, such as:

var func = fun(){
    var ret = 0;
    for (var i = 0; i < 50000; ++i) {
        ret %= i; // i=0 on first iteration triggers modulo by zero
    }
    return ret;
}
var fut1 = async(func);
print(" ${fut1.get()} ")

3. Execute the script: Supply the crafted file to the ChaiScript interpreter or the embedding application: ./chai crash.chai
4. Trigger crash: On the first loop iteration (i = 0), the ret %= i operation triggers a SIGFPE hardware exception in chaiscript::Boxed_Number::go at boxed_number.hpp:236, crashing the process and causing a denial of service (GitHub Issue #634).

• Process: Unexpected termination of the application embedding ChaiScript with a SIGFPE signal; crash dumps or core files referencing chaiscript::Boxed_Number::go in the stack trace.
• Logs: ASAN or sanitizer output containing AddressSanitizer: FPE and a stack trace pointing to boxed_number.hpp:236; application crash logs showing abnormal exit codes (e.g., signal 8 / SIGFPE).
• File System: Presence of suspicious .chai script files containing modulo or division operations with a zero literal or loop variable starting at zero (GitHub Issue #634).

No official patch has been released by the ChaiScript project as of the disclosure date, and the project had not responded to the issue report. As a workaround, operators should avoid exposing the ChaiScript interpreter to untrusted or user-supplied scripts. Applications embedding ChaiScript should implement input validation to reject scripts containing division or modulo operations with potentially zero operands before passing them to the engine. Monitoring for and restricting local access to ChaiScript-enabled applications reduces exposure, given the local-only attack vector (VulDB, GitHub Issue #634).

The vulnerability received routine automated coverage from vulnerability aggregators such as VulDB, Vulners, and CVEFeed. The ChaiScript project maintainers had not publicly responded to the GitHub issue as of the disclosure date. No notable security researcher commentary or significant media coverage was identified beyond standard CVE publication channels (VulDB, GitHub Issue #634).