Technical impact
The Espruino JavaScript interpreter contains a NULL pointer dereference flaw in the function jslGetRawString in src/jslex.c. Crafted raw or binary string data can cause the lexer to pass a NULL iterator to jsvLockAgain, leading to a write through a NULL pointer. In builds without assertions enabled, this memory corruption can crash the interpreter, resulting in application termination or denial of service. The vulnerability does not explicitly grant remote code execution, but the memory corruption could potentially be leveraged to execute arbitrary code in environments where the interpreter runs with elevated privileges.
Affected Systems
Any installation of Espruino based on commit bffc6d0 (v2.29) is affected. The issue manifests in RELEASE/NO_ASSERT builds where the missing assertion guard is present. Upgrades or patches that remove the vulnerable code path protect against this flaw.
Risk and Exploitability
Because the flaw requires crafted string input to the lexer, exploitation would typically require an attacker able to supply such input to the Espruino interpreter. The CVSS score of 6.2 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can cause denial of service without additional privilege escalation, and if the interpreter runs with privileged access, memory corruption could elevate to remote code execution. Therefore the risk assessment relies on the potential impact of a denial of service in mission‑critical devices.
