CVE-2026-110715
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
Risk Assessment
Malicious JavaScript can corrupt process memory, leading to a crash or potential arbitrary code execution in the context of the application using MuJS.
Recommendation
Upgrade MuJS to version 1.3.9 or later; until then, avoid executing untrusted JavaScript in the MuJS environment.
Other vulnerabilities in MuJS
See all- CVE-2016-10132High
The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.
- CVE-2016-9108High
Integer overflow in the js_regcomp function in regexp.c in MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.
- CVE-2017-5628High
An issue was discovered in MuJS before version 8f62ea10a0af68e56d5c00720523ebcba13c2e6a related to the MakeDay function in jsdate.c, which does not validate the month. This leads to an integer overflow when parsing a specially crafted JS file.
- CVE-2017-5627High
An issue was discovered in MuJS before version 4006739a28367c708dea19aeb19b8a1a9326ce08 related to the lack of a check for array length in the jsR_setproperty function. This leads to an integer overflow in the js_pushstring function when parsing a specially crafted JS file.
- CVE-2016-9109High
MuJS by Artifex Software allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. This vulnerability exists due to an incomplete fix for CVE-2016-7563.
- CVE-2016-7563High
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.
- CVE-2016-9136High
MuJS before version a0ceaf5050faf419401fe1b83acfa950ec8a8a89 by Artifex Software, Inc. allows context-dependent attackers to obtain sensitive information by using a crafted JavaScript approach, related to a 'Buffer Over-read' issue.
- CVE-2016-7506High
An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.
- CVE-2016-10133Critical
CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.
- CVE-2016-7505Critical
A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.
Original NVD description (English source)
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS