CVE-2026-110715
MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
Artifex Software MuJS
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.3.9MuJSCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
Text from CVE List
Affected versions 1
- MuJSaffected: 1.3.6 before 1.3.9CVE List
References 6
- codeberg.org/ccxvii/mujs/src/commit/307f18c4216420f2f56e22d8e7040baa39a6304a/jsarray.c#L245Fixvia CVE List
- codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396Fixvia CVE List
- vulncheck.com/advisories/mujs-1.3.6-before-1.3.9-heap-out-of-bounds-read-write-via-array-prototype-sortAdvisoryvia CVE List
- hackmd.io/@haind-pwn/mujs-array-length-flat-oobExploitvia CVE List
- mujs.com/downloads/Referencevia CVE List
- codeberg.org/ccxvii/mujsReferencevia CVE List