p PatchFirst

CVE-2026-110715

CVE-2026-110715 · MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mujs

    Versions
    • ≥ 1.3.6, < 1.3.9: Affected (semver)

    Update to 1.3.9

  • mujs Debian:12

    Versions
    • 1.3.10-1
    • 1.3.10-2
    • 1.3.2-1
    • 1.3.3-1
    • 1.3.3-2
    • 1.3.3-3
    • 1.3.5-1
    • 1.3.6-1
    • 1.3.7-1
    • 1.3.8-1
    • 1.3.8-2
    • 1.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Debian:13

    Versions
    • 1.3.10-1
    • 1.3.10-2
    • 1.3.6-1
    • 1.3.7-1
    • 1.3.8-1
    • 1.3.8-2
    • 1.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Debian:14

    Versions
    • 1.3.10-1
    • 1.3.10-2
    • 1.3.6-1
    • 1.3.7-1
    • 1.3.8-1
    • 1.3.8-2
    • 1.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Ubuntu:Pro:22.04:LTS

    Versions
    • 1.1.0-1
    • 1.1.3-2
    • 1.1.3-3
    • 1.1.3-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Ubuntu:24.04:LTS

    Versions
    • 1.3.3-1
    • 1.3.3-2
    • 1.3.3-3
    • 1.3.3-3build1
    • 1.3.3-3build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Ubuntu:26.10

    Versions
    • 1.3.8-2
    • 1.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mujs Ubuntu:26.04:LTS

    Versions
    • 1.3.6-1
    • 1.3.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →