CVE-2026-88389

Deferred Deferred - Pending Action

NULL Pointer Dereference in Espruino 2v29

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: MITRE

Description

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the missing assertion guard allows a write through the NULL pointer, resulting in memory corruption and application termination or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-88389

EUVD

EUVD-2026-87108

Affected Vendors & Products

Vendor	Product	Version / Range
espruino	espruino	2.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in Espruino 2v29 where crafted raw or binary string input causes the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, this leads to a write through the NULL pointer, causing memory corruption and either application termination or denial of service.

Detection Guidance

To detect this vulnerability, monitor for crashes or segmentation faults in Espruino applications when processing raw or binary string inputs. Check for NULL pointer dereference errors in logs. Test with malformed string inputs to trigger the issue. Use debug builds to catch assertions in affected versions.

Impact Analysis

This vulnerability can cause your Espruino application to crash or become unresponsive, leading to denial of service. It may also allow memory corruption, potentially enabling further exploitation or instability in the system running the affected software.

Compliance Impact

This vulnerability primarily causes denial-of-service or application crashes due to memory corruption from a NULL pointer dereference. It does not directly impact data confidentiality, integrity, or privacy required by standards like GDPR or HIPAA. However, repeated crashes could disrupt system availability, potentially affecting service-level agreements or operational compliance.

Mitigation Strategies

Update Espruino to a patched version that fixes the NULL pointer dereference in jslGetRawString(). Avoid processing raw/binary string input from untrusted sources to prevent memory corruption and application crashes.

Hi! I’m here to help you understand CVE-2026-88389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70