CVE-2026-12216
svaarala duktape duk_api_bytecode.c memory corruption
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jun 15, 2026
- Updated
- Jun 15, 2026
- Reserved
- Jun 14, 2026
Description
A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-119 Memory Corruption
Affected Products
| Product | Versions |
|---|---|
duktapesvaarala |
|
References
- VDB-370859 | svaarala duktape duk_api_bytecode.c memory corruptionvdb-entrytechnical-description
- VDB-370859 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-12216 | CVE Analysis and Reportthird-party-advisory
- Submit #833814 | Duktape https://github.com/svaarala/duktape <=2.99.99 Memory Corruptionthird-party-advisory
- https://github.com/hmKunlun/compileOOB/blob/main/api_bytecode.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.