The flaw resides in the scan_string function of berry 1.1.0, the language interpreter produced by berry‑lang. An attacker with local access can manipulate input to cause an out‑of‑bounds read, allowing the process to read memory beyond the intended buffer. This read can expose internal program data such as strings, configuration values or other sensitive information, potentially leading to information disclosure.

Berry language interpreter version 1.1.0, distributed by berry‑lang. Any installation of berry‑lang 1.1.0 that uses the vulnerable scan_string implementation is affected.

The vulnerability has a CVSS score of 4.8, indicating moderate severity. The EPSS score is below 1%, suggesting a very low current exploitation probability. It is not listed in the CISA KEV catalog. Because local privileges are required, the attack vector is local; a publicly disclosed exploit can be used by users with access to the system, but widespread remote exploitation has not been reported.