Hi,

The following vulnerability was published for mujs.

CVE-2026-88362[0]:
| MuJS e892c9fdb contains an incorrect numeric conversion
| vulnerability in jsR_isindex() in jsrun.c. A specially crafted
| JavaScript input containing an excessively large numeric array index
| can cause an out-of-range floating-point value to be converted to an
| integer without proper range validation. This results in undefined
| behavior and can cause process termination, leading to denial of
| service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88362
https://www.cve.org/CVERecord?id=CVE-2026-88362
[1] https://bugs.ghostscript.com/show_bug.cgi?id=709636
[2] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore