CVE-2026-86716

Summary

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

VendorProductVersion RangeStatus
CesantamJS1.0affected
CesantamJS1.1affected
CesantamJS1.2affected
CesantamJS1.3affected
CesantamJS1.4affected
CesantamJS1.5affected
CesantamJS1.6affected
CesantamJS1.7affected
CesantamJS1.8affected
CesantamJS1.9affected
CesantamJS1.10affected
CesantamJS1.11affected
CesantamJS1.12affected
CesantamJS1.13affected
CesantamJS1.14affected
CesantamJS1.15affected
CesantamJS1.16affected
CesantamJS1.17affected
CesantamJS1.18affected
CesantamJS1.19affected
CesantamJS1.20affected
CesantamJS1.21affected
CesantamJS1.22affected
CesantamJS1.23affected
CesantamJS1.24affected
CesantamJS1.25affected
CesantamJS1.26affected

Weaknesses

  • CWE-122: Heap-based Buffer Overflow
  • CWE-119: Memory Corruption

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References