Description
A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chaiscript_defines.hpp. The manipulation results in use after free. The attack requires a local approach. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-02-18
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: Use‑after‑free leading to memory corruption
Action: Apply Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the chaiscript::str_less::operator implementation within ChaiScript. An attacker with local execution privileges could trigger the vulnerability, potentially leading to memory corruption or program crash. The flaw requires local execution, is complex, and deemed difficult to exploit.

Affected Systems

ChaiScript releases prior to version 6.1.0 are affected. The issue involves the chaiscript_defines.hpp header in the ChaiScript library. No specific vendor versions beyond 6.1.0 are listed.

Risk and Exploitability

The CVSS score of 2.0 indicates a low severity, and the EPSS score of less than 1% further suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, reducing the expectation of in‑the‑wild attacks. Defensive measures must focus on updating the library or applying mitigation workarounds until an official patch is released.

Generated by OpenCVE AI on April 17, 2026 at 18:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ChaiScript to a version that addresses the use‑after‑free flaw, such as 6.1.1 or later, if available.
  • If a patch is not yet released, restrict local execution of untrusted scripts and isolate the ChaiScript runtime in a sandboxed environment to limit potential damage.
  • Subscribe to the ChaiScript project or security mailing lists to receive notifications about new releases or security fixes.

Generated by OpenCVE AI on April 17, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 19 Feb 2026 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:chaiscript:chaiscript:*:*:*:*:*:*:*:*

Thu, 19 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Chaiscript
Chaiscript chaiscript
Vendors & Products Chaiscript
Chaiscript chaiscript

Wed, 18 Feb 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::str_less::operator of the file include/chaiscript/chaiscript_defines.hpp. The manipulation results in use after free. The attack requires a local approach. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title ChaiScript chaiscript_defines.hpp operator use after free
Weaknesses CWE-119
CWE-416
References
Metrics cvssV2_0

{'score': 1, 'vector': 'AV:L/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.5, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Chaiscript Chaiscript
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:17:43.776Z

Reserved: 2026-02-18T06:43:13.411Z

Link: CVE-2026-2655

cve-icon Vulnrichment

Updated: 2026-02-18T14:39:21.859Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-18T14:16:07.490

Modified: 2026-02-19T17:22:36.310

Link: CVE-2026-2655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T18:45:25Z

Weaknesses