{"id":"CVE-2026-110715","revision":"51d33e45bd194941b6224b9b158df218","records":[{"revision":"51d33e45bd194941b6224b9b158df218","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110715","aliases":[],"title":"MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort","description":"MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.","state":0,"publishedAt":"2026-10-14T15:01:29.904+00:00","modifiedAt":"2026-10-15T19:13:59.76+00:00","affected":[{"ecosystem":"https://codeberg.org/ccxvii/mujs","name":"MuJS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Artifex Software\",\n                    \"product\": \"MuJS\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.3.6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"1.3.9\"\n                        }\n                    ],\n                    \"collectionURL\": \"https://codeberg.org/ccxvii/mujs\",\n                    \"repo\": \"https://codeberg.org/ccxvii/mujs\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","score":6.1,"severity":"MEDIUM"}],"references":["https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob","https://codeberg.org/ccxvii/mujs/src/commit/307f18c4216420f2f56e22d8e7040baa39a6304a/jsarray.c#L245","https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396","https://mujs.com/downloads/","https://codeberg.org/ccxvii/mujs","https://www.vulncheck.com/advisories/mujs-1.3.6-before-1.3.9-heap-out-of-bounds-read-write-via-array-prototype-sort"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110715","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110715","identifiers":["CVE-2026-110715"]},"retained":false,"historicalAffected":[]}],"coverage":[]}