Heap Out-of-Bounds Vulnerability in MuJS JavaScript Engine
CVE-2026-110715

6.9MEDIUM

Key Information:

Vendor: Artifex Software
Status: Mujs
Vendor: CVE Published:; 14 October 2026

🔔 Create Artifex Software Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110715?

The MuJS JavaScript engine, specifically version 1.3.6 and earlier, contains a vulnerability that allows attackers to exploit a heap out-of-bounds read and write via Array.prototype.sort. By manipulating the length of a dense array in JavaScript, a malicious actor can cause the sorting algorithm to access memory locations beyond the allocated buffer. This can lead to memory corruption, resulting in potential application crashes. Implementing the fix available in versions 1.3.9 and later is crucial for maintaining the stability and security of applications using MuJS.

Affected Version(s)

MuJS 1.3.6 < 1.3.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110715 - Proof of Concept