This vulnerability in janet-lang janet affects the doframe function in src/core/debug.c, allowing an attacker with local access to cause an out-of-bounds read. The flaw exists in versions up to 1.41.0. The vulnerability has a CVSS 4.8 score indicating medium severity, with low attack complexity and requiring local privileges. An exploit has been publicly released. A patch commit is known but no official vendor advisory or confirmed remediation level is provided.

The vulnerability allows a local attacker to perform an out-of-bounds read, which may lead to information disclosure or application instability. There is no indication of privilege escalation, remote exploitation, or denial of service in the provided data. The medium severity rating reflects limited impact and local attack vector.

A patch commit (ed17dd2c5913a23fb1107251e44a9410a3c30cf5) addressing this vulnerability has been identified. However, the official remediation status is not confirmed in the vendor advisory. Users should apply the patch if available from the janet-lang project repository or monitor the vendor for an official fix. Since exploitation requires local access, restricting local user permissions may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.