CVE-2026-88390

Name of the Vulnerable Software and Affected Versions Espruino version 2v29

Description An out-of-bounds write occurs in the jslGetTokenValueAsString() function when processing crafted JavaScript input containing an overlong token. In RELEASE/NO ASSERT builds, this triggers a one-byte write beyond the JsLex.token buffer, which corrupts the adjacent tokenValue pointer. This memory corruption can lead to application crashes or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.