CVE-2026-88362

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.

Published 2026-09-24. Last modified 2026-09-25.