This vulnerability involves an integer overflow in the unmarshal_one_fiber function within the janet-lang janet project, specifically in the src/core/marsh.c source file. The flaw allows local attackers to manipulate data to cause an integer overflow condition. The issue affects all versions up to and including 1.41.0. The vulnerability has a CVSS 4.8 (medium) score, indicating a moderate level of risk. Although an exploit is publicly available, exploitation requires local access and low privileges. The vendor has released a patch (commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d) to fix the vulnerability.

Successful exploitation of this vulnerability could lead to an integer overflow, potentially causing unexpected behavior or memory corruption within the affected function. Because the attack requires local access and low privileges, the impact is limited to local users. There is no indication of remote exploitation or privilege escalation from the provided data. The medium severity reflects the moderate risk posed by this vulnerability.

A patch is available and should be applied to all affected versions of janet-lang janet up to 1.41.0. The patch is identified by commit d9b1d711ea1fde52ac73a82088b512a3e17bad0d. Applying this official fix will remediate the integer overflow vulnerability. No additional mitigation steps are indicated by the vendor advisory.