CVE-2026-88390 in Espruino
Zusammenfassung
von MITRE • 24.09.2026
An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.