Executive brief
Duktape is an embeddable Javascript engine used in various software applications. A vulnerability in how it handles compiled code (bytecode) allows a local attacker to cause memory corruption. This could lead to application crashes or potentially allow an attacker to access sensitive information stored in the computer's memory.
Technical details
A heap-based out-of-bounds read exists in Duktape's bytecode loader (duk_api_bytecode.c). The vulnerability stems from the use of the DUK_ASSERT macro for critical bounds checking of the 'count_instr' field; because DUK_ASSERT is defined as a no-op in Release builds, these checks are effectively removed. An attacker can craft malicious bytecode with an inflated instruction count and a truncated buffer, forcing the loader to read past the allocated heap memory. This results in the interpretation of heap garbage as bytecode instructions, leading to memory corruption or information disclosure. The issue affects versions up to 2.99.99, and a public exploit (PoC) has been released.
Affected products
- Svaarala Duktape up to 2.99.99
Timeline
- 2026-06-15: disclosed: Vulnerability disclosed and CVE assigned
- 2026-06-15: advisory: NVD and VulDB publish details