CVE-2026-12216

svaarala duktape duk_api_bytecode.c memory corruption

View on CVE.org
Published Jun 15, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title svaarala duktape duk_api_bytecode.c memory corruption
First Time appeared Svaarala
Svaarala duktape
Weaknesses CWE-119
CPEs cpe:2.3:a:svaarala:duktape:*:*:*:*:*:*:*:*
Vendors & Products Svaarala
Svaarala duktape
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jun 15, 2026, 1:19 PM
Reserved
Jun 14, 2026, 1:43 PM

View source JSON

Updated
Jun 15, 2026, 1:19 PM

JSON

Status
Deferred
Published
Jun 15, 2026, 4:16 AM
Modified
Jul 24, 2026, 12:10 PM

View source JSON

Severity
Moderate
Public date
Jun 15, 2026, 3:45 AM

View source Bugzilla JSON

Updated
Jun 15, 2026, 6:45 AM

JSON