CVE-2026-88362
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation.
Risk Assessment
This results in undefined behavior and can cause process termination, leading to denial of service. An attacker can supply a malicious JavaScript script to crash the MuJS interpreter.
Recommendation
Update MuJS to a version containing the fix, or add range validation before converting a floating-point value to an integer in jsR_isindex(). Consider limiting the size of array indices processed in JavaScript scripts.
Other vulnerabilities in MuJS
See all- CVE-2016-10132High
The MuJS library from Artifex Software, Inc. has a vulnerability that allows attackers to cause a system crash via NULL pointer dereference during regular expression compilation.
- CVE-2016-9108High
Integer overflow in the js_regcomp function in regexp.c in MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.
- CVE-2017-5628High
An issue was discovered in MuJS before version 8f62ea10a0af68e56d5c00720523ebcba13c2e6a related to the MakeDay function in jsdate.c, which does not validate the month. This leads to an integer overflow when parsing a specially crafted JS file.
- CVE-2017-5627High
An issue was discovered in MuJS before version 4006739a28367c708dea19aeb19b8a1a9326ce08 related to the lack of a check for array length in the jsR_setproperty function. This leads to an integer overflow in the js_pushstring function when parsing a specially crafted JS file.
- CVE-2016-9109High
MuJS by Artifex Software allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. This vulnerability exists due to an incomplete fix for CVE-2016-7563.
- CVE-2016-7563High
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input.
- CVE-2016-9136High
MuJS before version a0ceaf5050faf419401fe1b83acfa950ec8a8a89 by Artifex Software, Inc. allows context-dependent attackers to obtain sensitive information by using a crafted JavaScript approach, related to a 'Buffer Over-read' issue.
- CVE-2016-7506High
An out-of-bounds read vulnerability was observed in the Sp_replace_regexp function of Artifex Software, Inc. MuJS before version 5000749f5afe3b956fc916e407309de840997f4a. Successful exploitation of this issue can lead to code execution or denial of service condition.
- CVE-2016-10133Critical
CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.
- CVE-2016-7505Critical
A buffer overflow vulnerability was observed in the divby function of MuJS before version 8c805b4eb19cf2af689c860b77e6111d2ee439d5. Successful exploitation of this issue can lead to code execution or denial of service condition.
Original NVD description (English source)
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS