CVE-2026-3384: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3384 is an uncontrolled recursion (stack overflow) vulnerability in ChaiScript, an embedded scripting language designed for C++. It affects all versions up to and including 6.1.0, which is the latest release. The vulnerability was reported via a GitHub issue on January 19, 2026, and publicly disclosed on March 1, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (VulDB, RedHat CVE).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-404 (Improper Resource Shutdown or Release), located in the functions chaiscript::eval::AST_Node_Impl::eval and chaiscript::eval::Function_Push_Pop within include/chaiscript/language/chaiscript_eval.hpp. An attacker can craft a ChaiScript file that defines a user-defined operator which calls itself recursively inside a string interpolation block (e.g., ${this/= 2}), causing an infinite eval_function -> AST_Node::eval call chain. ChaiScript lacks a sufficient guard against stack exhaustion for this specific recursion pattern, resulting in a hard crash (SEGV/stack overflow). The attack requires local access and the ability to supply a malicious script to the ChaiScript interpreter. A public proof-of-concept is available via the GitHub issue report (GitHub Issue #633).

Successful exploitation causes the host process running ChaiScript to crash due to stack exhaustion, resulting in a denial-of-service (DoS) condition. There is no impact on confidentiality or integrity — only availability is affected. Applications embedding ChaiScript as a scripting engine that allow user-supplied scripts are at risk of process termination (GitHub Issue #633, VulDB).

A proof-of-concept exploit has been publicly disclosed via the ChaiScript GitHub issue tracker, and the CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The vulnerability requires local access and low privileges (the ability to run a crafted .chai script). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term (VulDB, RedHat CVE).

1. Prepare the environment: Obtain access to a system running an application that embeds ChaiScript v6.1.0 or earlier, or install the ChaiScript interpreter (chai) directly.
2. Craft the malicious script: Create a .chai file containing a user-defined operator that recursively calls itself within a string interpolation block:

def string::`/=`(double d) {
    this = "${this/= 2}/=${d}";
    return this;
}
var s = "o World"
s /= 2

3. Execute the script: Run the crafted file against the ChaiScript interpreter: ./chai crash.chai
4. Trigger stack overflow: The engine evaluates s /= 2, which calls the custom operator. The string interpolation ${this/= 2} inside the function body immediately re-invokes the same operator, creating an infinite eval_function -> AST_Node::eval recursion chain until the stack is exhausted.
5. Achieve DoS: The host process crashes with a SEGV (stack overflow), confirmed by AddressSanitizer as a fatal stack-overflow signal (GitHub Issue #633).

• Process: Unexpected crash or SEGV signal from a process embedding ChaiScript; process termination with exit code indicating a fatal signal (e.g., signal 11/SIGSEGV).
• Logs: AddressSanitizer output containing ERROR: AddressSanitizer: stack-overflow with stack frames referencing chaiscript::eval::AST_Node_Impl::eval or chaiscript::eval::Function_Push_Pop in chaiscript_eval.hpp.
• File System: Presence of unexpected .chai script files in directories accessible to the ChaiScript interpreter, particularly files containing user-defined operators with string interpolation patterns like ${this/= ...}.
• Core Dumps: Core dump files generated by the host process at the time of crash, referencing ChaiScript evaluation functions deep in the stack trace (GitHub Issue #633).

No official patch has been released by the ChaiScript project as of the disclosure date — the maintainers had not responded to the issue report at time of publication. Since ChaiScript 6.1.0 is the latest release (from May 2018) and the project appears largely unmaintained, users should consider the following mitigations: (1) avoid exposing the ChaiScript interpreter to untrusted user-supplied scripts; (2) implement application-level recursion depth limits or script sandboxing before passing input to the engine; (3) evaluate replacing ChaiScript with an actively maintained scripting library if untrusted input handling is required (GitHub Issue #633, ChaiScript Repo).

The vulnerability was initially reported by a researcher (user 'oneafter') via the ChaiScript GitHub issue tracker on January 19, 2026, with a detailed ASAN report and PoC. The ChaiScript project has not responded to the issue as of the disclosure date, reflecting the project's largely dormant maintenance status (last release in 2018). The CVE was assigned by VulDB and noted by automated vulnerability tracking services including ENISA EUVD and Red Hat's CVE database, but has not attracted significant broader security community commentary given its limited scope and local-only attack vector (GitHub Issue #633, RedHat CVE).