CVE-2026-3385 Details

A heap-buffer-underflow vulnerability leading to stack exhaustion has been identified in the Wren programming language, specifically in versions up to 0.4.0. The issue arises in the 'resolveLocal' function within 'src/vm/wren_compiler.c', where the compiler fails to control recursion properly. This flaw allows for excessive nesting of code blocks, causing the parser to enter a deep recursive state—over 300 frames deep—which can corrupt memory or miscalculate pointers when accessing local variables. As a result, the 'bcmp' function reads memory 766 bytes before the allocated buffer, creating a potential exploitation vector.