CVE-2026-88390 Details
Description
An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial of service.
A vulnerability allowing out-of-bounds write has been identified in the jslGetTokenValueAsString() function of Espruino version 2v29 (commit bffc6d0). This vulnerability arises when crafted JavaScript input containing an overly long token is processed, leading to a one-byte write beyond the allocated buffer. The out-of-bounds write corrupts an adjacent pointer, causing memory corruption that could result in application crashes or a denial-of-service condition. This issue is present in RELEASE builds where assertions are disabled.
The vulnerability has been addressed in a commit that ensures the jslGetTokenValueAsString() function properly handles long tokens by cropping the length before writing a null terminator, preventing the out-of-bounds write. Users should update to the latest version of Espruino where this fix is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/espruino/Espruino/issues/2744 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/espruino/Espruino/commit/ecd7d43e084ba9aafa8245609347fe0f4383b38c | [email protected] | Source CodeVendor |
| https://github.com/espruino/Espruino/issues/2744 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Espruino | 2v29 (commit bffc6d0) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |