CVE-2026-88388
UnknownSummary
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory.
Risk Assessment
Remote code execution or denial of service is possible by supplying specially crafted JavaScript input. The vulnerability affects only 64-bit builds.
Recommendation
Upgrade Espruino to a version newer than 2v29 (commit bffc6d0) that includes the fix. Until then, avoid running untrusted JavaScript code in the Espruino environment.
Other vulnerabilities in Espruino
See all- CVE-2026-88389Unknown
Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(), leading to memory corruption and application termination or denial of service in RELEASE/NO_ASSERT builds.
- CVE-2026-88390High
In Espruino 2v29 (commit bffc6d0), the jslGetTokenValueAsString() function has an out-of-bounds write vulnerability. Crafted JavaScript input with an overlong token can trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds, corrupting the adjacent tokenValue pointer and leading to memory corruption, application crashes, or denial of service.
Original NVD description (English source)
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS