The reported flaw is a null pointer dereference in the getByteCountForArguments function of wren’s compiler, which can cause the interpreter to crash or terminate unexpectedly. Because the error occurs during argument handling, a malformed script or data supplied locally can trigger this failure, resulting in a denial of service for any process running wren. The vulnerability is classified as a local fault; it does not provide the attacker with code execution or privilege escalation capabilities.

The issue applies to the wren programming language maintained by wren-lang, with affected releases up to and including version 0.4.0. Any systems that embed or run wren scripts built with these versions are potentially vulnerable.

The CVSS score of 4.8 indicates a moderate risk, and the EPSS score of less than 1 % shows that, at the time of analysis, the probability of exploitation observed in the wild is very low. The vulnerability is only exploitable by someone with local access to the environment running wren; it is not remotely reachable, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the exploit has been disclosed publicly, users must monitor for a patch and limit local privileges until a fix is applied. The likely attack vector is local; an attacker would need to supply crafted input to the interpreter.