EUVD-2026-86283
GHSA-jh95-x4h9-f49q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted JavaScript to MuJS host
-
DeliveryInclude excessively large numeric array index
-
ExploitjsR_isindex out-of-range float-to-int conversion
-
ExecutionUndefined behavior triggers process termination
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires that the target application embeds the MuJS interpreter (git revision e892c9fdb or thereabouts) AND evaluates attacker-supplied JavaScript. The concrete trigger is a JS input that constructs an excessively large numeric array index, causing jsR_isindex() in jsrun.c to convert an out-of-range floating-point value to an integer without validation. Limiting factors: MuJS is a library, so exploitability is gated by whether the host exposes script evaluation to untrusted input - many embeddings (e.g. document processing) require a user to open attacker-supplied content, and a hardened host may sandbox or restart the interpreter, reducing impact to a single crashed worker rather than a full outage. |
| Impact | This is a denial-of-service-only issue (CWE-681 incorrect numeric conversion) with no confidentiality or integrity impact. NVD scores it 7.5 via CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but that network/unauthenticated rating is optimistic for what is actually an embeddable JavaScript library: reachability depends entirely on how the host application exposes MuJS to attacker-controlled script, so 'AV:N' is only true where a MuJS-backed service accepts remote JS input. The exploitation-likelihood signals are all low: EPSS is 0.15% (4th percentile), the CVE is not in CISA KEV, and no public exploit code is referenced - only a Ghostscript bug report and the fixing commit. Exploitation status: no public exploit identified at time of analysis. The single-signal disagreement worth flagging is scope-of-vector versus impact: even where triggerable, the worst outcome is a process crash (A:H), which for a sandboxed/embedded interpreter is a resilience concern rather than a system-compromise priority. Net: high CVSS on paper, but low real-world urgency - a patch-in-normal-cycle DoS, not an emergency. |
| Exploit ScenarioDerived | An attacker supplies a crafted JavaScript snippet containing an excessively large numeric array index to an application that embeds MuJS for script evaluation. When jsR_isindex() converts the out-of-range floating-point value to an integer without range validation, undefined behavior terminates the process, denying service to that application. No public proof-of-concept is currently referenced, and the practical attack surface depends on whether the embedding application exposes MuJS to untrusted script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Denial of service in the MuJS embeddable JavaScript interpreter (git revision e892c9fdb) allows remote attackers to crash the hosting process by supplying JavaScript that builds an excessively large numeric array index, which jsR_isindex() in jsrun.c converts from floating point to integer without validating the value fits in the target integer range. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I/A:H), the attack is network-reachable and unauthenticated, but the impact is availability-only: no confidentiality or integrity loss, with exploitability gated by whether the embedding application evaluates untrusted JavaScript. Exploitation requires the host to feed attacker-controlled script to the embedded interpreter (for example, opening a document or file that MuJS parses), and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.15% (4th percentile), indicating low near-term exploitation likelihood. The upstream project has published a fix commit, but no tagged patched release has been independently confirmed.
RemediationAI
The upstream fix is available as MuJS commit 8a32c397b28fe45747ac4e9e4f3dca049825eda7 (referenced from the CVE alongside Ghostscript Bugzilla issue 709636), so the primary remediation is to rebuild MuJS from a revision at or after that commit - or, for downstream products such as Ghostscript, to move to a release that bundles the patched MuJS source; note that no tagged MuJS release version is confirmed in the provided data, so verify the fix commit is actually present in the tree before trusting a version label. Because the bug is triggered by evaluating attacker-supplied JavaScript, the most effective compensating control where patching is delayed is to eliminate that input path: do not let untrusted users supply scripts to MuJS-backed features, and where document or file parsing invokes the interpreter (e.g. Ghostscript converting untrusted input), disable the JavaScript/scripting capability or process such content only in a locked-down context. Where script evaluation cannot be disabled, isolate the interpreter in a short-lived sandboxed worker that is supervised and restarted on crash, which converts the undefined-behavior abort into a failed job rather than a sustained outage - at the cost of added CPU overhead and loss of in-process state. Pre-scanning or length-limiting numeric array indices before they reach the interpreter is only a partial mitigation, since it depends on accurately reproducing the trigger; restricting network exposure of any service that proxies script evaluation reduces reachability but does not remove the flaw. Review the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-88362) for updated guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MuJS is a lightweight, dependency-free ECMAScript interpreter written in C and commonly embedded in larger applications (notably Ghostscript) to evaluate JavaScript. The flaw is an incorrect conversion between numeric types (CWE-681): the helper jsR_isindex() in jsrun.c is responsible for deciding whether a JavaScript number can be treated as a valid array index. When a script produces an extremely large numeric index, the double-to-integer conversion is performed without a range check against the integer's representable bounds, so an out-of-range floating-point value is silently reinterpreted or left in an undefined state. That undefined behavior typically manifests as a crash or abnormal termination of the process running the interpreter. Because MuJS is a library rather than a service, the practical attack surface is defined by the host application: the vulnerability is only reachable where attacker-supplied JavaScript is evaluated. The CPE data supplied with this CVE is unpopulated (cpe:2.3:a:n/a:n/a), so version-based matching is unreliable; affected code should instead be identified by the MuJS git revision in use (e892c9fdb and nearby revisions) and, for downstream consumers, by the MuJS revision bundled with the host product (for example, Ghostscript).
Know when Mujs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Kept A:H DoS with C:N/I:N; AV:N/PR:N/UI:N retained to match the library's worst-case network-facing embedding, though many real deployments would be AV:L or UI:R.
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
Executive ViewAI
MuJS, an embeddable JavaScript interpreter used in applications that parse untrusted scripts, has a high-severity denial-of-service flaw that can crash the hosting process when fed crafted JavaScript. Organizations embedding the vulnerable revision e892c9fdb in services that evaluate attacker-controlled JavaScript face potential service outages, though no public exploit identified at time of analysis and near-term likelihood is low. Leadership should prioritize identifying affected systems and applying interim mitigations because no vendor-released patch is currently available.
Sandbox MuJS execution in a low-privilege process, disable evaluation of untrusted JavaScript, validate and constrain numeric array indices, enforce memory and process limits, monitor for crashes, and apply upstream fix when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A use-after-free vulnerability was observed in Rp_toString function of Artifex Software, Inc. Rated critical severity (C
A buffer overflow vulnerability was observed in divby function of Artifex Software, Inc. Rated critical severity (CVSS 9
Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c. Rated high severi
Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape seq
An out-of-bounds read vulnerability was observed in Sp_replace_regexp function of Artifex Software, Inc. Rated high seve
Artifex Software, Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication req
The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via
Heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS allows attackers to caus
Artifex Software, Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication req
Heap out-of-bounds read and write in MuJS 1.3.6 through 1.3.8 allows attackers to corrupt process memory by supplying Ja
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. Rated criti
Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. Rated critical severity
Exploit-DB