CVE-2026-110715: MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and Apsortswap to access slots past the buffer and crash the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
MuJS versions 1.3.6 through versions before 1.3.9 are affected. Exposure requires a deployment that executes attacker-supplied JavaScript.
What does an attacker need to trigger the issue?
An attacker needs to provide JavaScript that increases the length of a dense array and then invokes Array.prototype.sort. The supplied script can cause sort internals to access array slots beyond the allocated buffer.
Is user interaction required?
Yes. The supplied severity vector indicates user interaction is required, and the attack vector is local. No privileges are required according to the vector.
What is the observed impact?
Out-of-bounds reads and writes can corrupt memory and crash the MuJS process. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.