The issue occurs in the resolveLocal routine of Wren’s compiler and allows a local attacker to trigger uncontrolled recursion. The recursion can exhaust stack or heap resources, resulting in a crash or unresponsive state of the compiling process or the entire host application. The weakness is a classic uncontrolled recursion flaw, reflected in the CWE-674 identifier. No remote execution is possible; the attacker must have local code execution capability to trigger the effect.

The vulnerability is present in all Wren releases up to and including 0.4.0. No specific sub‑version range is listed beyond the upper bound, and the CVE catalog identifies the vendor as wren-lang and the product as Wren.

The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% signals that public exploitation is currently unlikely. The vulnerability is not in the CISA KEV list. Attacking requires local exploitation, so the attack surface is restricted to insiders or compromised local accounts. A local attacker that can invoke the Wren compiler can force a denial of service by exhausting resources, but no privacy or integrity impact would normally result unless the attacker can influence other processes.