CVE-2026-88388: Buffer Overflow
Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a sizet pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The vulnerability is described in Espruino 2v29 at commit bffc6d0, and it affects 64-bit builds. The provided data does not establish whether other versions, commits, or 32-bit builds are affected.
What must an attacker be able to do to trigger the overflow?
An attacker must be able to supply JavaScript input remotely. That input must trigger an exception and reach the jslPrintTokenLineMarker() error stack-trace handling path.
Is a default configuration known to be affected?
No default-configuration status is provided. Exposure depends on whether the target is a 64-bit affected build and accepts attacker-controlled JavaScript that can reach the exception stack-trace path.
What can be done if patching is not immediately possible?
The available data supports limiting or preventing remote submission of untrusted JavaScript, particularly input that can trigger exceptions. No specific configuration workaround is provided.