CVE-2026-2656

low-risk
Published 2026-02-18

A flaw has been found in ChaiScript up to 6.1.0. This affects the function chaiscript::Type_Info::bare_equal of the file include/chaiscript/dispatchkit/type_info.hpp. This manipulation causes use after free. The attack requires local access. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.5/10 Low
LOCAL / HIGH complexity

Affected Products (1)

Chaiscript

Affected Vendors

Chaiscript

References (6)

Product https://github.com/ChaiScript/ChaiScript/
Exploit https://github.com/ChaiScript/ChaiScript/issues/636
Exploit https://github.com/ChaiScript/ChaiScript/issues/636#issue-3828333582
Third Party Advisory https://vuldb.com/?ctiid.346454
Third Party Advisory https://vuldb.com/?id.346454
Third Party Advisory https://vuldb.com/?submit.752790
11
/ 100
low-risk
Severity 6/34 · Minimal
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal