CVE-2026-12216

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
svaarala	duktape	2.99.0; 2.99.1; 2.99.2; 2.99.3; 2.99.4; 2.99.5; 2.99.6; 2.99.7; 2.99.8; 2.99.9; 2.99.10; 2.99.11; 2.99.12; 2.99.13; 2.99.14; 2.99.15; 2.99.16; 2.99.17; 2.99.18; 2.99.19

References

Timeline

Published: Jun 15, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1221606.3A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the f CVE-2026-1221625.5Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.CVE-2026-1221637.5Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.CVE-2026-1221648.0Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2026-1221657.8Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.CVE-2026-1221667.8Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-1221676.8Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1221687.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.CVE-2026-1221697.5Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.CVE-2026-122177.8A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of t CVE-2026-1221707.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-1221718.8Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.