CVE-2026-3285 - Vulnerability Analysis

Overview

berry-lang berry <= 1.1.0 contains an out-of-bounds read caused by improper handling in scan_string function in src/be_lexer.c, letting local attackers read memory out of bounds, exploit requires local access.

Severity & Score

Impact

Local attackers can read memory out of bounds, potentially exposing sensitive information or causing application crashes.

Mitigation

Apply the patch 7149c59a39ba44feca261b12f06089f265fec176 or update to a version after 1.1.0.

References

• https://vuldb.com/?id.348014
• https://vuldb.com/?submit.758872
• https://github.com/berry-lang/berry/
• https://github.com/berry-lang/berry/commit/7149c59a39ba44feca261b12f06089f265fec176
• https://github.com/berry-lang/berry/issues/509
• https://github.com/berry-lang/berry/pull/511
• https://github.com/oneafter/0211/blob/main/be/repro
• https://vuldb.com/?ctiid.348014

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner