CVE-2026-3383 identifies a divide-by-zero vulnerability in ChaiScript, an embedded scripting language commonly used to add scripting capabilities to C++ applications. The vulnerability resides in the function chaiscript::Boxed_Number::go within the file boxed_number.hpp. This function handles numeric operations, and due to insufficient input validation or error handling, it can perform a division by zero when manipulated by a local attacker. The attack requires local access with limited privileges and does not require user interaction or elevated rights. The flaw can cause the affected application to crash or behave unpredictably, leading to denial of service. The vulnerability affects ChaiScript versions 6.0 and 6.1.0. Although the issue was responsibly disclosed early, the project has not yet released a patch. Public exploit code is available, increasing the risk of exploitation in environments where ChaiScript is deployed locally. The CVSS 4.0 base score is 4.8, reflecting medium severity due to the limited attack vector and impact scope.

The primary impact of this vulnerability is denial of service through application crashes caused by divide-by-zero errors. For organizations embedding ChaiScript in their software, this could lead to service interruptions, reduced reliability, and potential disruption of business operations. While the vulnerability does not directly lead to privilege escalation or data compromise, denial of service in critical systems could have cascading effects, especially in embedded or industrial control environments where ChaiScript might be used. Since exploitation requires local access, remote attackers cannot exploit this directly, limiting the threat to insiders or attackers who have already gained some foothold. However, the availability of public exploit code lowers the barrier for attackers with local access to cause disruption.

Organizations should monitor for updates from the ChaiScript project and apply patches promptly once available. Until a patch is released, mitigations include restricting local access to systems running vulnerable versions of ChaiScript, enforcing strict access controls and user permissions to limit who can execute or manipulate scripts. Application developers should consider implementing input validation and error handling around numeric operations in their use of ChaiScript to prevent divide-by-zero conditions. Additionally, deploying runtime monitoring and crash detection can help identify exploitation attempts early. If possible, disabling or sandboxing scripting features that use ChaiScript can reduce the attack surface. Finally, conducting code audits and testing for similar numeric vulnerabilities in custom scripts or extensions is recommended.