Heap Out-of-Bounds Read/Write in MuJS

Executive Summary

MuJS 1.3.6 through 1.3.8 has a heap out-of-bounds read and write flaw in Array.prototype.sort. Attackers can inflate a dense array's logical length beyond its physical buffer capacity. When sort() is called, the heapsort algorithm accesses memory slots past the allocated buffer, causing crashes or memory corruption. The issue stems from mujs tracking logical length separately from physical buffer size, allowing misalignment during sorting operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MuJS version is between 1.3.6 and 1.3.8. Run `mujs -v` or inspect the library version in your package manager. If vulnerable, test with a proof-of-concept script that inflates an array length and calls sort(). Monitor for crashes or memory corruption during execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause application crashes when processing malicious JavaScript. It may lead to denial-of-service conditions or memory corruption, potentially allowing attackers to execute arbitrary code on affected systems. Systems using vulnerable MuJS versions in web browsers, servers, or embedded applications are at risk if they process untrusted input.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. However, it could indirectly impact compliance by enabling memory corruption attacks that may lead to unauthorized data access, processing, or disclosure. Such breaches could violate GDPR's data protection principles or HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade MuJS to version 1.3.9 or later immediately. If upgrading is not possible, apply the patch from the official repository that clamps the sort length to the buffer capacity. Avoid using vulnerable versions in production environments until patched.

Useful 0 Not Useful 0