Hi,

The following vulnerability was published for mujs.

CVE-2026-88362[0]:
| MuJS e892c9fdb contains an incorrect numeric conversion
| vulnerability in jsR_isindex() in jsrun.c. A specially crafted
| JavaScript input containing an excessively large numeric array index
| can cause an out-of-range floating-point value to be converted to an
| integer without proper range validation. This results in undefined
| behavior and can cause process termination, leading to denial of
| service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88362
https://www.cve.org/CVERecord?id=CVE-2026-88362
[1] https://bugs.ghostscript.com/show_bug.cgi?id=709636
[2] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
mujs, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149057@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Daniel Echeverri <epsilon@debian.org> (supplier of updated mujs package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 26 Sep 2026 23:17:12 -0500
Source: mujs
Architecture: source
Version: 1.3.10-2
Distribution: unstable
Urgency: medium
Maintainer: Daniel Echeverri <epsilon@debian.org>
Changed-By: Daniel Echeverri <epsilon@debian.org>
Closes: 1149057
Changes:
 mujs (1.3.10-2) unstable; urgency=medium
 .
   * debian/patches
     + Add CVE-2026-88362.diff (Closes: #1149057)
       + Fix undefined behavior casting out-of-range int to double
Checksums-Sha1:
 e1698746cac3d0139d622287d558b629ee64201a 1941 mujs_1.3.10-2.dsc
 c6e1df7e59e0a53860cad854737ee063c3d6db0e 7436 mujs_1.3.10-2.debian.tar.xz
 7dddfb74af72983d54a68cc44f738f11bf6156f4 6885 mujs_1.3.10-2_amd64.buildinfo
Checksums-Sha256:
 99c17393a239af1c44b142241c85ac4e0dccff98b58d7c495c706ec68c920f3f 1941 mujs_1.3.10-2.dsc
 ff6d03c5cabf39753bba6015811264ee2ffb20df8cf206dc48a4e299d1bcc6f3 7436 mujs_1.3.10-2.debian.tar.xz
 d3af067e76dac7ddeae0c28a66439cc8f5c322461485f45bf0c152acd5fb3cdf 6885 mujs_1.3.10-2_amd64.buildinfo
Files:
 f776249ab83dbfb4e83ca94503960d9b 1941 javascript optional mujs_1.3.10-2.dsc
 dca7288d647e77398e1a62404320a684 7436 javascript optional mujs_1.3.10-2.debian.tar.xz
 ce2cf59e4209e87e051076b78ba39426 6885 javascript optional mujs_1.3.10-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE0NCFsWnDv9lASFj6IfwpUEtSMNsFAmq4pPoTHGVwc2lsb25A
ZGViaWFuLm9yZwAKCRAh/ClQS1Iw299rD/9EFPqf19Hz/4LYwePFfIF0rohEJO6i
GHpWH8o7Bv1azRa+EQiXw3cJUrXHn1z2SfYJEbNySYxbBYPwrvx1Q3SZAkTYs2Vg
2Eo54ZOF0UsdvzSO78HFkxJTsXO0NcUpSCuvIu5s+Z3TvsJNgaeuU/CtMTxmqcBs
2DZkpxYVa8nE0x1IE3Y8X6+DeNj+Ec/99Ql6D6P+LfGk7hbqeOCj68P6W0OuFA94
n8fuIwAmWKcXbyORzI0WEBlj6xTPDBGh/1nx0EbZHCxKEcnszwCHsmZFHi8trOzE
gsBp3cv6k+F3dJfj3uNLJFGZr4Ua37C7czwN9twoPUljU+ejpgNWsvxAv5rilRT/
KTRPZa3jqQoFGxQkbLB6khLQzN7PgeOqjnv1CWyPiLipuCzwL/3XHq+MxmSPLhVt
+ZgOmOugbcdXeSZeXueXhQPZy5qdOmoeDuTTwxbJdEAMF5qP+3yRBZJh0NXxzSTQ
pshB7lM5Y2twF43i9THk1Z5qIv0hjdmTz/NnF79CnSgM7Q0xAfr6Cu38Fgnq+YiS
v0rFCIC+AQByzI5zl8ExwWvcZG4IJk6zJSCiTXz42wkypAxX+HzanzCTnxNizmNB
HNSTz0ZNoXajUJuRiJb+bRDf/kvGPEEckqmA6KMYqL6z7kQ7CjeJDLIq2gc1b/mq
UdmxwFjrAMwmZA==
=EmRP
-----END PGP SIGNATURE-----

According to the description of CVE-2026-88362, this is actually the
opposite: double to int. In practice, converting an int to double
cannot be out of range.

| MuJS e892c9fdb contains an incorrect numeric conversion
| vulnerability in jsR_isindex() in jsrun.c. A specially crafted
| JavaScript input containing an excessively large numeric array index
| can cause an out-of-range floating-point value to be converted to an
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| integer without proper range validation. This results in undefined
  ^^^^^^^
| behavior and can cause process termination, leading to denial of
| service.