CVE-2026-3385 - wren-lang wren wren_compiler.c resolveLocal recursion

Back Back to CVE browser

MEDIUM

wren-lang wren wren_compiler.c resolveLocal recursion

Published Mar 1, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Wren-Lang Product Wren Default
n/a
- Version
  0.1
  Status
  affected
  Constraints
  -
- Version
  0.2
  Status
  affected
  Constraints
  -
- Version
  0.3
  Status
  affected
  Constraints
  -
- Version
  0.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wren-Lang

Wren

n/a

Version	Status	Constraints
0.1	affected	-
0.2	affected	-
0.3	affected	-
0.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-404

Improper Resource Shutdown or Release

CWE-674

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9120
Advisory
https://github.com/oneafter/0122/blob/main/i1218/repro
exploit
https://github.com/wren-lang/wren/
product
https://github.com/wren-lang/wren/issues/1218
issue-trackingExploitIssue TrackingVendor Advisory
https://vuldb.com/?ctiid.348271
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.348271
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.761305
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9120		Advisory
https://github.com/oneafter/0122/blob/main/i1218/repro		exploit
https://github.com/wren-lang/wren/		product
https://github.com/wren-lang/wren/issues/1218		issue-trackingExploitIssue TrackingVendor Advisory
https://vuldb.com/?ctiid.348271		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.348271		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.761305		third-party-advisoryThird Party AdvisoryVDB Entry