Bug 2552402 (CVE-2026-110715)

Summary: CVE-2026-110715 mujs: mujs: Memory corruption via out-of-bounds access in Array.prototype.sort
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in MuJS. The JavaScript engine fails to properly validate array boundaries when sorting an array whose length property has been enlarged. By supplying specially crafted JavaScript code, an attacker can trigger out-of-bounds memory operations, potentially leading to memory corruption or a Denial of Service (DoS) caused by an application crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2553654    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-14 15:37:25 UTC 
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.