CVE-2026-88362 Integer overflow in n/a
An attacker can cause a denial of service in MuJS by providing a crafted JavaScript input with an excessively large array index, leading to process termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88362?
CVE-2026-88362 is a high-severity vulnerability in n/a, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.
Weakness: CWE-681
Which versions are affected by CVE-2026-88362?
How do I fix CVE-2026-88362?
Apply the vendor's patch.
Is CVE-2026-88362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88362 exists.
Sources
Also known as DEBIAN-CVE-2026-88362, GHSA-jh95-x4h9-f49q, UBUNTU-CVE-2026-88362.