MuJS CVE-2026-110715

Exploitation requires that the target application embedding MuJS 1.3.6, 1.3.7, or 1.3.8 execute attacker-controlled JavaScript; the specific trigger is script that enlarges a simple/dense array's length property and then invokes Array.prototype.sort, driving Ap_sort_cmp and Ap_sort_swap to access slots beyond the allocated heap buffer. Limiting factors: the CVSS 4.0 vector is local (AV:L) with passive user interaction (UI:P), meaning an attacker cannot reach the flaw over the network directly but must get a victim to open or process a malicious script/document; deployments that only ever run trusted, first-party JavaScript are not exposed. Versions at or above 1.3.9 are patched.

This is a genuine but moderate-priority memory-corruption flaw, not a drop-everything emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, score 6.9) describes a local attack vector requiring passive user interaction, with the dominant impact being availability (process crash) plus limited integrity impact, and no confidentiality loss. A public proof-of-concept exists (the hackmd write-up and the referenced VulnCheck advisory), which raises the practical likelihood of opportunistic exploitation, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active in-the-wild exploitation. The signals are internally consistent: a CWE-787 out-of-bounds write in a scripting engine, reachable only by getting the target to execute attacker-supplied JavaScript (UI:P / local vector), aligns with an embedded-interpreter threat model rather than a remote network service. The main caveat is that CVSS caps integrity at Low and does not credit code execution, yet a heap OOB read AND write in a JS engine is frequently a primitive that skilled attackers escalate toward RCE; the official score likely reflects the reliably-demonstrated crash rather than the theoretical ceiling. Net: real priority for anyone embedding MuJS and feeding it untrusted scripts/PDFs, but lower urgency where MuJS only ever runs trusted scripts.

An attacker crafts a malicious document or script containing JavaScript that inflates a dense array's length and then calls Array.prototype.sort; when a victim opens the file in an application embedding MuJS 1.3.6-1.3.8, Ap_sort_cmp and Ap_sort_swap access heap slots past the allocated buffer, corrupting memory and crashing the process. A public proof-of-concept write-up is available, lowering the barrier to reproduction; because the vector is local with passive user interaction, exploitation depends on delivering the script to a context that will execute it.