CVE-2026-88362 Details
Description
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
A vulnerability in MuJS version master has been identified, where the jsR_isindex() function in jsrun.c improperly converts large numeric array indices from floating-point to integer. This flaw arises because the conversion lacks adequate range validation, allowing out-of-range values to be processed. The resulting undefined behavior can lead to process termination, causing a denial-of-service condition.
The vulnerability has been fixed in MuJS. Users should update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.ghostscript.com/show_bug.cgi?id=709636 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://bugs.ghostscript.com/show_bug.cgi?id=709636 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-681 | Incorrect Conversion between Numeric Types | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MuJS | master |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |