MuJS 1.3.6 to 1.3.8 suffer a heap out‑of‑bounds read and write in the Array.prototype.sort routine. By enlarging a dense array’s length and invoking sort, the internal comparison and swap functions access memory past the allocated buffer, causing memory corruption and typically crashing the MuJS process.

Artifex Software’s MuJS JavaScript engine, versions 1.3.6, 1.3.7, and 1.3.8, is affected. These releases are included in the 1.3.x series used in embedded and server contexts that host MuJS for script handling.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of 0.00172 (below 1%) indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker must be able to supply or influence JavaScript executed by MuJS. With such access, the attacker can corrupt memory and cause a denial‑of‑service by crashing the process.