CVE-2026-88362
CVE-2026-88362
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
mujs Debian:12
- Versions
- 1.3.10-1
- 1.3.10-2
- 1.3.2-1
- 1.3.3-1
- 1.3.3-2
- 1.3.3-3
- 1.3.5-1
- 1.3.6-1
- 1.3.7-1
- 1.3.8-1
- 1.3.8-2
- 1.3.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mujs Debian:13
- Versions
- 1.3.10-1
- 1.3.10-2
- 1.3.6-1
- 1.3.7-1
- 1.3.8-1
- 1.3.8-2
- 1.3.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mujs Debian:14
- Versions
- 1.3.10-1
- 1.3.6-1
- 1.3.7-1
- 1.3.8-1
- 1.3.8-2
- 1.3.9-1
- Affected ranges
- ECOSYSTEM: < 1.3.10-2
Update to 1.3.10-2
mujs Ubuntu:Pro:22.04:LTS
- Versions
- 1.1.0-1
- 1.1.3-2
- 1.1.3-3
- 1.1.3-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mujs Ubuntu:24.04:LTS
- Versions
- 1.3.3-1
- 1.3.3-2
- 1.3.3-3
- 1.3.3-3build1
- 1.3.3-3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mujs Ubuntu:26.10
- Versions
- 1.3.8-2
- 1.3.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mujs Ubuntu:26.04:LTS
- Versions
- 1.3.6-1
- 1.3.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published