Espruino CVE-2026-88389

Requires the ability to feed crafted raw/binary string input into the Espruino lexer (jslGetRawString in src/jslex.c) - i.e., the attacker must supply script or raw-string source to the interpreter, which is Espruino's normal input path via REPL, serial/USB console, or script loading. Critically, exploitation is limited to RELEASE/NO_ASSERT builds: assertion-enabled (debug) builds catch the NULL iterator and abort safely. Impact is confined to memory corruption and process termination (denial of service) of the interpreter itself; there is no confidentiality or integrity impact. The CVSS vector indicates a local attack vector (AV:L), so remote network exploitation is not implied unless the interpreter is exposed over a network-facing input channel.

This is a genuine but low-priority issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) describes a local, availability-only NULL pointer dereference - no confidentiality or integrity impact, only crash/DoS. EPSS is very low at 0.14% (3rd percentile), it is NOT in CISA KEV, and no public exploit was identified in the supplied data (the GitHub issue #2745 and the fix commit are referenced, but there is no weaponized POC). All signals align in the same direction: low real-world exploitation likelihood and impact limited to termination of the Espruino process. The one nuance worth stating explicitly is that the flaw only manifests in RELEASE/NO_ASSERT builds - debug/assert-enabled builds catch the NULL iterator via the assertion guard, so exploitability is build-configuration dependent. Exploitation also presupposes the attacker can already feed crafted script/raw-string input to the interpreter, which on a JavaScript runtime is the normal operating mode rather than a privilege boundary. Net: a real, vendor-fixed bug, but not an urgent priority.

An attacker who can submit JavaScript source or raw/binary string input to an Espruino interpreter (e.g., via a REPL, serial/USB console, or a script-loading interface) supplies a malformed raw string that pushes the lexer's string iterator to EOF and frees lex->it.var. jslGetRawString() then passes the resulting NULL iterator target to jsvLockAgain(), and on a RELEASE/NO_ASSERT build the missing assertion allows a write through the NULL pointer, corrupting memory and terminating the interpreter. No public exploit code was identified, though the triggering issue and fix commit are public.