CVE-2026-12216
MEDIUMsvaarala duktape duk_api_bytecode.c memory corruption
Title source: cnaDescription
A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-370859 | svaarala duktape duk_api_bytecode.c memory corruption
https://vuldb.com/vuln/370859
Signature, Permissions Required signature
permissions-required
VDB-370859 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/370859/cti
Third Party Advisory third-party-advisory
CVE-2026-12216 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-12216
Third Party Advisory third-party-advisory
Submit #833814 | Duktape https://github.com/svaarala/duktape <=2.99.99 Memory Corruption
https://vuldb.com/submit/833814
Scores
CVSS v3
5.3
EPSS
0.0011
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-119
Status
published
Products (50)
svaarala/duktape
2.99.0
svaarala/duktape
2.99.1
svaarala/duktape
2.99.10
svaarala/duktape
2.99.11
svaarala/duktape
2.99.12
svaarala/duktape
2.99.13
svaarala/duktape
2.99.14
svaarala/duktape
2.99.15
svaarala/duktape
2.99.16
svaarala/duktape
2.99.17
... and 40 more
Published
Jun 15, 2026
Tracked Since
Jun 15, 2026