Stack-Based Buffer Overflow in Espruino 2v29

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description

Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-88388

Affected Vendors & Products

Vendor	Product	Version / Range
espruino	espruino	2.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

Espruino 2v29 has a stack-based buffer overflow in JavaScript error stack-trace handling on 64-bit builds. An attacker can send JavaScript that triggers an exception, leading to a function writing 8 bytes to the wrong memory location due to a type mismatch. This corrupts adjacent stack memory.

Impact Analysis

This flaw allows remote attackers to execute arbitrary code or crash the system by sending specially crafted JavaScript input. It could lead to denial of service or potential remote code execution on affected devices running Espruino 2v29 on 64-bit systems.

Mitigation Strategies

Update Espruino to a patched version that fixes the stack-based buffer overflow in error stack-trace handling. Avoid using untrusted JavaScript input in Espruino environments until patched.

Hi! I’m here to help you understand CVE-2026-88388. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70