Medium severity · published Mar 1, 2026
CVE-2026-3384
ChaiScript chaiscript_eval.hpp Function_Push_Pop recursion
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
ChaiScript ·
6.0; 6.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3384
Product
https://github.com/ChaiScript/ChaiScript/
Issue Tracking
https://github.com/ChaiScript/ChaiScript/issues/633
Issue Tracking
https://github.com/ChaiScript/ChaiScript/issues/633#issue-3828176056
Permissions Required
https://vuldb.com/?ctiid.348270
Third Party Advisory
https://vuldb.com/?id.348270
Third Party Advisory
https://vuldb.com/?submit.761303
More from ChaiScript
5.5
CVE-2026-3383
ChaiScript boxed_number.hpp go divide by zero
5.5
CVE-2026-3382
ChaiScript boxed_number.hpp get_as memory corruption
2.5
CVE-2026-2656
ChaiScript type_info.hpp bare_equal use after free
2.5
CVE-2026-2655
ChaiScript chaiscript_defines.hpp operator use after free
