Espruino
CVE-2022-25044
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.
AnalysisAI
Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString. Affected products include: Espruino.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).
Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling. Rated high
There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a de
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Pri
Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at sr
Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Discl
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclos
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi
Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi
Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today