CVE-2019-1010176

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-25 · updated 2026-06-17
Weakness: CWE-787

Description

JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:377). The attack vector is: executing crafted javascript code. The fixed version is: after commit 505dace719aebb3308a3af223cfaa985159efae0.

Affected products

JerryScript: before 2.0 — fixed in 2.0

How to fix

Upgrade to a fixed version: JerryScript 2.0. Check the vendor advisory for mitigations.

References

https://github.com/jerryscript-project/jerryscript/issues/2476
https://github.com/jerryscript-project/jerryscript/issues/2476

Get alerted when CVE-2019-1010176 or the next vulnerability affects your stack