CVE-2026-88362: Mujs Mujs vulnerability
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs to cause MuJS to process specially crafted JavaScript containing an excessively large numeric array index. The reported impact is process termination through undefined behavior.
Is this vulnerability known to allow code execution or data disclosure?
No. The provided information identifies the impact as denial of service caused by process termination; it does not state that code execution or information disclosure is possible.
Which MuJS versions are affected or fixed?
The available data identifies the affected code as MuJS e892c9fdb and references a commit, but it does not provide released version ranges or a confirmed fixed release.