Description
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Artifex Software | MuJS | 1.3.6 – < 1.3.9 | 1.3.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mujs | 1.3.11-1 | — |
| Debian 13 | mujs | No fix yet | — |
| Debian 12 | mujs | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mujs | No fix yet | — |
| Ubuntu 26.04 LTS | mujs | No fix yet | — |
| Ubuntu 24.04 LTS | mujs | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | mujs | No fix yet | — |
References
- https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob technical-description exploit
- https://codeberg.org/ccxvii/mujs/src/commit/307f18c4216420f2f56e22d8e7040baa39a6304a/jsarray.c#L245 technical-description
- https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396 patch
- https://mujs.com/downloads/ release-notes
- https://codeberg.org/ccxvii/mujs product
- VulnCheck Advisory: MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort third-party-advisory