CVE-2026-88388

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 (commit bffc6d0)

Description A stack-based buffer overflow exists in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can provide JavaScript input that triggers an exception, leading to the execution of the jslPrintTokenLineMarker() function. This function passes the address of a 4-byte int column variable to the jsvGetLineAndCol() function as a size t pointer. Consequently, jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, which overwrites adjacent stack memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.