CVE-2026-3384CWE-404CWE-674

ChaiScript chaiscript_eval.hpp Function_Push_Pop recursion

Medium · published March 1, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00189 · 8.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-674 · Uncontrolled Recursion
Published
2026-03-01T08:02Z
EPSS history
Timeline
  • 01 MAR 08:02Z
    ChaiScript chaiscript_eval.hpp Function_Push_Pop recursion
    cvelistv5