An out-of-bounds read vulnerability exists in the os_strftime function of janet-lang's core library. When a specially crafted input is processed, the function performs a read beyond the bounds of an internal buffer, potentially exposing sensitive data from memory. This flaw does not provide direct code execution but can leak confidential information from the local process space. The weakness is identified as a buffer overread, classified under the Common Weakness Enumeration identifiers CWE-119 and CWE-125.

The affected product is janet-lang:janet, up to and including version 1.40.1. No newer releases are listed as currently patched. All builds of the language that include the vulnerable os_strftime implementation before the referenced commit are subject to this issue.

The CVSS score for this vulnerability is 4.8, indicating a moderate impact and limited exploitation potential. The EPSS score is below 1 %, implying a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the attack must be initiated locally and the exploit has already been made public, any adversary with local access to a system running an affected version could perform a memory disclosure. No remote attack vector or elevated privileges are required beyond local execution.