CVE-2026-88389: Null Pointer Dereference
Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the NULL pointer, resulting in memory corruption and application termination or denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to memory corruption from this issue?
Deployments built in RELEASE or NO_ASSERT configurations are most exposed. In those builds, the missing assertion guard permits a write through a NULL pointer when crafted raw or binary string input reaches the affected lexer path.
What must an attacker be able to supply?
An attacker needs to be able to provide crafted raw or binary string input that is processed by the Espruino lexer. The input must cause jslGetRawString() to pass a NULL iterator target to jsvLockAgain().
How can I identify a potentially affected build?
The reported affected version is Espruino 2v29 at commit bffc6d0. Builds using RELEASE or NO_ASSERT settings should be prioritized because the assertion guard is absent in those configurations.