CVE-2026-2858

A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the component Source File Parser. Such manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-119
• CWE-125
• CWE-125

• https://github.com/oneafter/0122/blob/main/i1217/reproIssue Tracking, Product
• https://github.com/wren-lang/wren/Product
• https://github.com/wren-lang/wren/issues/1217Issue Tracking
• https://vuldb.com/?ctiid.347097Permissions Required, VDB Entry
• https://vuldb.com/?id.347097Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.754489Third Party Advisory, VDB Entry

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2857A vulnerability was determined in D-Link DWR-M960 1.01.07. A…8.8
• CVE-2026-28573In AndroidManifest.xml, there is a possible persistent denia…5.5
• CVE-2026-28575In PackageInstaller.Session#transfer of frameworks/base/serv…5.5
• CVE-2026-28576In Contacts Provider, there is a possible way to access the …5.5
• CVE-2026-28577In addWindow of WindowManagerService.java, there is a possib…7.8
• CVE-2026-28578In multiple functions of DevicePolicyManagerService.java, th…5.5
• CVE-2026-28580In multiple functions, there is a possible desync in persist…7.8
• CVE-2026-28581In fixInitiatingUserIfNecessary of CallIntentProcessor.java,…4
• CVE-2026-28586In multiple functions of AppOpsService.java, there is a poss…3.3
• CVE-2026-28587In MmsSmsProvider of MmsSmsProvider.java, there is a possibl…5.5
• CVE-2026-2859Improper permission enforcement in Checkmk versions 2.4.0 be…4.3
• CVE-2026-2860A security vulnerability has been detected in feng_ha_ha/meg…6.3