The vulnerability lies in the printError function of wren's compiler component, where improper handling of error messages can overflow a stack buffer. This flaw allows an attacker with local access to corrupt the stack, potentially leading to execution of arbitrary code or a crash. The weakness corresponds to CWE-119 and CWE-121, indicating unsafe memory handling and lack of bounds checking. The impact is confined to denial of service or local privilege escalation, depending on the execution context of the vulnerable process.

The affected product is wren-lang’s Wren interpreter, up to version 0.4.0. No later version information is provided, so any installation of the specified range should be considered vulnerable. The vulnerability is tied to the wren component listed as wren-lang:wren in the CNA data.

The CVSS base score is 4.8, indicating a low to moderate severity. The EPSS score is below 1 percent, showing a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack execution requires local access, so remote exploitation is unlikely without additional compromise. The lack of a public exploit suggests limited exploitation, but the local nature of the vulnerability means it can be abused by users with sufficient privileges on the host running Wren.