Espruino 2v29 contains a stack‑based buffer overflow in the error stack‑trace handling path. The flaw arises when an exception causes jslPrintTokenLineMarker() to pass the address of a 4‑byte integer as a size_t pointer to jsvGetLineAndCol(), which then writes 8 bytes to an invalid location, overwriting adjacent stack data. The out‑of‑bounds write can corrupt control data such as return addresses, potentially giving a remote attacker the ability to execute arbitrary code.

The vulnerable code is part of Espruino version 2v29, identified by the commit bffc6d0. Only 64‑bit builds are affected. The flaw exists in the core JavaScript engine handling error stack traces; other platform components are not directly impacted.

The CVSS score is 7.5, the EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is that a remote attacker can supply arbitrary JavaScript that triggers an exception and invokes the faulty stack‑trace routine. Successful exploitation would require control over the input to the JavaScript engine. It is inferred that, because the vulnerability affects only the internal stack of the process, exploitation could allow escalation within the host environment.