A use‑after‑free flaw has been exposed in the bare_equal function of ChaiScript's type_info.hpp. The vulnerability arises when a previously freed memory block is accessed again, which is a use after free weakness (CWE‑416) and an improper memory access (CWE‑119). This could allow an attacker to corrupt data or cause a crash. The issue is localized to the internal implementation of type comparisons and is not tied to external inputs.

All installations of ChaiScript up to and including version 6.1.0 are affected. The defect is present in the core library shipped with these releases and applies to any project that directly or indirectly uses the bare_equal routine.

Exploitation is limited to local users and demands significant effort: the attack requires local access, has a high complexity rating, and is deemed difficult to exploit. The CVSS score of 2 indicates low severity, and the EPSS score of less than 1% reflects very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, further underscoring its low immediate threat but still warranting remediation. If successful, the exploit could lead to arbitrary memory corruption or process termination, potentially elevating local privileges within the affected environment.