Medium severity · published Mar 1, 2026
CVE-2026-3383
ChaiScript boxed_number.hpp go divide by zero
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/boxed_number.hpp. Executing a manipulation can lead to divide by zero. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
ChaiScript ·
6.0; 6.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3383
Product
https://github.com/ChaiScript/ChaiScript/
Issue Tracking
https://github.com/ChaiScript/ChaiScript/issues/634
Issue Tracking
https://github.com/ChaiScript/ChaiScript/issues/634#issue-3828234470
Permissions Required
https://vuldb.com/?ctiid.348269
Third Party Advisory
https://vuldb.com/?id.348269
Third Party Advisory
https://vuldb.com/?submit.761302
More from ChaiScript
5.5
CVE-2026-3384
ChaiScript chaiscript_eval.hpp Function_Push_Pop recursion
5.5
CVE-2026-3382
ChaiScript boxed_number.hpp get_as memory corruption
2.5
CVE-2026-2656
ChaiScript type_info.hpp bare_equal use after free
2.5
CVE-2026-2655
ChaiScript chaiscript_defines.hpp operator use after free