CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service.

• Published Sep 24, 2026
• CVSS 7.5 high
• 0.3% chance of exploitation in the next 30 days (EPSS)
• A fix is available

CVE-2026-88362 at the National Vulnerability Database