A flaw in the janetc_if function of the Janet language interpreter allows a crafted input to trigger an out-of-bounds read. The entry confirms the existence of the read vulnerability but does not detail which data may be exposed; it merely states that a manipulation can lead beyond intended boundaries. Based on the nature of an out-of-bounds read, it is inferred that an attacker could potentially read sensitive memory contents, but this information disclosure is not explicitly documented in the CVE entry.

All releases of the Janet language interpreter up to version 1.40.1 are affected, including the core library’s specials.c module. The patch identified by commit c43e06672cd9dacf2122c99f362120a17c34b391 resolves this issue. Users should verify that their installed interpreter is not older than 1.40.1 and update accordingly.

The CVSS base score of 4.8 indicates moderate severity, while the EPSS score of less than 1% signifies a low probability of exploitation. The vulnerability is only exploitable locally, requiring the attacker to run code on the same system that executes Janet. It is not listed on the CISA KEV catalog, further limiting its exposure. Overall, the risk is moderate but confined to local environments.