An out-of-bounds write occurs in the jslGetTokenValueAsString() function of the Espruino JavaScript engine when an excessively long token is parsed. The write places a one‑byte value beyond the JsLex.token buffer, corrupting the adjacent tokenValue pointer. This memory corruption can cause the interpreter to crash or otherwise fail, leading to a denial of service. The vulnerability does not provide a path to arbitrary code execution.

The flaw is present in Espruino version 2v29 (commit bffc6d0) compiled with the RELEASE/NO_ASSERT flag. Debug or assertion‑enabled builds are not affected. No other vendors or product variants are documented as impacted.

The CVSS score of 7.7 places the weakness in the high‑severity range, while the EPSS score is reported as less than 1%, indicating a very low but non‑zero likelihood of exploitation from publicly available sources. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is delivering crafted JavaScript containing an overlong token through any interface that accepts untrusted scripts, such as network‑exposed input to an embedded device or file uploads. Exploitation requires such input to be parsed by the interpreter. The primary risk is service disruption; the attack does not directly scale to privilege escalation or code execution.