CVE-2022-44789

State: Published
Severity: 8.8 High
Published: Nov 23, 2022
Updated: Apr 25, 2025
Reserved: Nov 7, 2022

Description

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3544a0e9045e8a8c60561f
https://github.com/alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt
https://github.com/ccxvii/mujs/releases/tag/1.3.2
DSA-5291vendor-advisory
FEDORA-2022-c4b56e4400vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.