CVE-2026-88362

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: MITRE

Description

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-14

NVD

CVE-2026-88362

EUVD

EUVD-2026-86283

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-681	When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

Executive Summary

This vulnerability is in MuJS library where a function called jsR_isindex() incorrectly converts a floating-point number to an integer without checking if the value is within valid range. When a JavaScript input uses an extremely large numeric array index, it causes an invalid integer conversion leading to undefined behavior.

Detection Guidance

This vulnerability is specific to MuJS and requires examining the jsR_isindex() function in jsrun.c for improper numeric conversion handling. No direct network or system detection commands are provided in the CVE details. Manual code review or static analysis tools targeting MuJS versions with this issue may help identify vulnerable implementations.

Impact Analysis

An attacker could exploit this to crash applications using MuJS by providing specially crafted JavaScript code. This would cause a denial of service by terminating the process unexpectedly.

Compliance Impact

This vulnerability causes denial of service through process termination, which could disrupt systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, specific compliance impacts depend on system context and implementation.

Mitigation Strategies

Update MuJS to the latest version that fixes the incorrect numeric conversion in jsR_isindex(). Avoid processing untrusted JavaScript inputs with excessively large numeric array indices.

Hi! I’m here to help you understand CVE-2026-88362. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70