CVE-2026-12216

Vulnerability

In Duktape up to version 2.99.99, the bytecode loader in duk_api_bytecode.c uses the DUK_ASSERT macro for bounds checking on the count_instr field. In Release builds, DUK_ASSERT is a no-op, so the bounds check is removed. By providing a bytecode buffer with an inflated count_instr value and a truncated buffer that ends at the instruction data boundary, the loader reads 4 bytes past the heap allocation, leading to memory corruption [1].

Exploitation

The attacker requires local access to the system running Duktape. The exploit involves crafting a bytecode buffer where the count_instr field is increased by one, and the buffer is truncated so that only the header and the original instruction data are present. When duk_load_function is called, the loader reads 4 extra bytes beyond the allocated buffer, which are then interpreted as bytecode instructions. The provided proof-of-concept code demonstrates this by modifying a dumped function's bytecode and loading it [1].

Impact

Successful exploitation results in an out-of-bounds read of 4 bytes from heap memory. This can lead to memory corruption, potentially causing a crash or information disclosure. The attacker may be able to read sensitive data from adjacent heap memory. The vulnerability is classified as medium severity (CVSS 5.3) due to the requirement of local access and the limited scope of the read.

Mitigation

As of the publication date, no official fix has been released by the vendor (svaarala), who did not respond to the disclosure. Users are advised to avoid loading untrusted bytecode in Release builds, or to use Debug builds where DUK_ASSERT is active. Alternatively, apply a patch that replaces DUK_ASSERT with a proper runtime bounds check. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.