CVE-2026-3385: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3385 is an uncontrolled recursion vulnerability in the wren-lang Wren scripting language affecting all versions up to and including 0.4.0. The flaw resides in the resolveLocal function within src/vm/wren_compiler.c and can be triggered by supplying deeply nested Wren source code to the compiler, leading to stack exhaustion and a heap-buffer-overflow (underflow). It was reported via a GitHub issue on January 22, 2026, and publicly disclosed on March 1, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Feedly, Wren Issue).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-404 (Improper Resource Shutdown or Release). Wren's recursive-descent parser does not enforce a nesting depth limit; when processing deeply nested control structures (e.g., many nested for loops), the call chain statement → definition → finishBlock → loopBody → forStatement repeats 300+ times, exhausting the call stack (Wren Issue). At extreme depth, resolveLocal (at wren_compiler.c:1539) performs a bcmp call that reads memory 766 bytes before the start of the allocated source buffer — an out-of-bounds read caused by an invalid or negative index into the compiler's local-variable table. Exploitation requires local access with low privileges; an attacker must be able to supply a crafted .wren script to a process that embeds the Wren VM (Feedly). A public proof-of-concept reproducer file is available (PoC Repro).

Successful exploitation causes a denial-of-service condition by crashing the host process that embeds the Wren VM through stack exhaustion or a heap-buffer-overflow (underflow). There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications that accept untrusted Wren scripts for execution (e.g., game engines, scripting hosts, or developer tools embedding Wren) are at risk of process crashes, potentially disrupting service for legitimate users (Wren Issue, Feedly).

A public proof-of-concept reproducer is available on GitHub and was submitted alongside the original bug report (PoC Repro, Wren Issue). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Prepare the environment: Obtain a build of wren-lang Wren version 0.4.0 or earlier, or identify an application that embeds the Wren VM and accepts user-supplied scripts.
2. Craft the malicious script: Create a Wren source file containing deeply nested control structures — for example, hundreds of nested for loops — sufficient to drive the recursive-descent parser to 300+ call frames. The public reproducer file at https://github.com/oneafter/0122/blob/main/i1218/repro demonstrates this payload.
3. Submit the script: Pass the crafted file to the Wren interpreter or the embedding application (e.g., ./wren_vm malicious.wren or via the application's scripting interface).
4. Trigger the crash: The parser recursively processes statement → definition → finishBlock → loopBody → forStatement, exhausting the stack. When resolveLocal is called at wren_compiler.c:1539, it performs an out-of-bounds bcmp read, causing a heap-buffer-overflow (underflow) and crashing the process (Wren Issue).

• Process: Unexpected crash or segmentation fault in a process embedding the Wren VM (e.g., a game engine or scripting host), particularly when processing user-supplied .wren files.
• Logs: AddressSanitizer (ASan) reports referencing resolveLocal in wren_compiler.c:1539 and bcmp; stack traces showing 300+ recursive frames cycling through statement, definition, finishBlock, loopBody, and forStatement.
• File System: Presence of unusually large or deeply nested .wren script files submitted to the application; core dump files generated by the crashing Wren host process.
• Network (if applicable): Unexpected script upload or submission requests to an application endpoint that processes Wren scripts, especially files with repetitive nested loop patterns (Wren Issue).

Upgrade wren-lang Wren to a version newer than 0.4.0 once a patched release is available; the vulnerability has been addressed in the upstream repository (Feedly). As of disclosure, the wren-lang project had not yet responded to the issue report, so organizations should monitor the Wren GitHub repository for a patched release. In the interim, restrict local access to systems or applications that process untrusted Wren scripts, and consider implementing application-level input validation to reject scripts with excessive nesting depth before passing them to the Wren VM.

The vulnerability was reported to the wren-lang project via GitHub Issue #1218 on January 22, 2026, but the project had not responded as of the disclosure date (Wren Issue). Red Hat acknowledged the CVE in their security advisory tracker (Red Hat CVE). Community discussion has been limited, with automated CVE tracking services (VulDB, Vulners, CIRCL) picking up the disclosure; no significant researcher commentary or media coverage has been identified beyond routine vulnerability aggregation.