CVE-2026-88389
Beschrijving NL
Espruino 2v29 (commit bffc6d0) bevat een NULL pointer dereference kwetsbaarheid in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT-BUILDS maakt de ontbrekende assertiewacht het mogelijk om door de nulwijzer te schrijven, wat resulteert in geheugenbeschadiging en beëindiging of weigering van service van de toepassing.
Origineel (Engels) tonen
Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the missing assertion guard allows a write through the NULL pointer, resulting in memory corruption and application termination or denial of service.