CVE-2022-44789

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

2.48% chance of exploitation in the next 30 days, 84th percentile

Published

2022-11-23

Updated

2025-04-25

Proof-of-concept exploits (1)

• alalng/CVE-2022-4478912★ · 2023-01-28

Security advisories

• alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt
• ccxvii/mujs/releases/tag/1.3.2
• https://www.debian.org/security/2022/dsa-5291

References

• CVE Record
• NVD entry