CVE-2026-88362
Deferred Deferred - Pending Action

Incorrect Numeric Conversion in MuJS Leading to Denial of Service

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88362
EUVD
EUVD-2026-86283

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in MuJS library where a function called jsR_isindex() incorrectly converts a floating-point number to an integer without checking if the value is within valid range. When a JavaScript input uses an extremely large numeric array index, it causes an invalid integer conversion leading to undefined behavior.

Detection Guidance

This vulnerability is specific to MuJS and requires examining the jsR_isindex() function in jsrun.c for improper numeric conversion handling. No direct network or system detection commands are provided in the CVE details. Manual code review or static analysis tools targeting MuJS versions with this issue may help identify vulnerable implementations.

Impact Analysis

An attacker could exploit this to crash applications using MuJS by providing specially crafted JavaScript code. This would cause a denial of service by terminating the process unexpectedly.

Compliance Impact

This vulnerability causes denial of service through process termination, which could disrupt systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, specific compliance impacts depend on system context and implementation.

Mitigation Strategies

Update MuJS to the latest version that fixes the incorrect numeric conversion in jsR_isindex(). Avoid processing untrusted JavaScript inputs with excessively large numeric array indices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88362. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart