Security readout for executives and security teams
Plain-English summary
CVE-2026-3285 affects berry-lang berry up to 1.1.0. A flaw in string parsing can trigger an out-of-bounds read when used locally. Business urgency is moderate: exploitation requires local, low-privileged access, but public exploit material is referenced and a patch commit is available.
Executive priority
Treat as a routine but timely patching item. It is not a remote critical issue based on current evidence, but public exploit disclosure increases the need to update systems with local multi-user or script-processing exposure.
Technical view
The issue is in scan_string in src/be_lexer.c, classified as CWE-119 and CWE-125. CVSS v4.0 is 4.8 with local attack vector, low complexity, low privileges, no user interaction, and low confidentiality impact only. Sources identify patch commit 7149c59a39ba44feca261b12f06089f265fec176.
Likely exposure
Exposure is most likely where berry-lang berry 1.0 through 1.1.0 is installed, embedded, or used to process local Berry scripts. Remote exposure is not supported by the provided sources.
Exploitation context
The source bundle says the exploit has been publicly disclosed and may be utilized. It is not listed in KEV, and no cited source confirms active exploitation. Attack requires local access and low privileges.
Researcher notes
Validate assumptions around affected version ranges because the bundle lists 1.0 and 1.1.0 while also saying up to 1.1.0. Avoid claiming active exploitation without new evidence. The public repro should be handled as sensitive exploit material.
Mitigation direction
- Upgrade or apply berry-lang patch commit 7149c59a39ba44feca261b12f06089f265fec176.
- Prioritize systems where untrusted local users can run Berry code.
- Restrict local access to Berry execution environments until patched.
- Check upstream berry-lang issue and pull request for release guidance.
Validation and detection
- Inventory Berry installations and embedded dependencies.
- Confirm whether versions are 1.0, 1.1.0, or otherwise up to 1.1.0.
- Verify the patch commit is present in deployed source or package builds.
- Review logs or crash reports for abnormal Berry lexer failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3285 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-348014 | berry-lang berry be_lexer.c scan_string out-of-boundsCVE reference · vdb-entry, technical-description
- VDB-348014 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #758872 | berry-lang berry 7af8289 Buffer OverflowCVE reference · third-party-advisory
- https://github.com/berry-lang/berry/issues/509CVE reference · issue-tracking
- https://github.com/berry-lang/berry/pull/511CVE reference · issue-tracking, patch
- https://github.com/oneafter/0211/blob/main/be/reproCVE reference · exploit
- https://github.com/berry-lang/berry/commit/7149c59a39ba44feca261b12f06089f265fec176CVE reference · patch
- https://github.com/berry-lang/berry/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.