---
id: CVE-2026-110715
title: >-
  MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write
  vulnerability in Array.prototype.sort that allows attackers to corrupt memory
  by inflating a simple array's length
summary: >-
  MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write
  vulnerability in Array.prototype.sort that allows attackers to corrupt memory
  by inflating a simple array's length. Attackers can supply JavaScript that
  enlarges a dens…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cwe:
  - CWE-787
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:43.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110715'
references:
  - url: 'https://codeberg.org/ccxvii/mujs'
    label: disclosure@vulncheck.com
  - url: >-
      https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396
    label: disclosure@vulncheck.com
  - url: >-
      https://codeberg.org/ccxvii/mujs/src/commit/307f18c4216420f2f56e22d8e7040baa39a6304a/jsarray.c#L245
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob'
    label: disclosure@vulncheck.com
  - url: 'https://mujs.com/downloads/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mujs-1.3.6-before-1.3.9-heap-out-of-bounds-read-write-via-array-prototype-sort
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T16:40:32.116Z'
---

## Overview

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.