Vulnerability · Published Jun 15, 2026 · Assigned by VulDB
CVE-2026-12216svaarala duktape duk_api_bytecode.c memory corruption
Medium 5.3
In plain English
A medium-severity memory corruption in duktape from svaarala. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | duktape | no fix listed | DEBIAN-CVE-2026-12216 |
| Debian:13 | duktape | no fix listed | DEBIAN-CVE-2026-12216 |
| Debian:14 | duktape | no fix listed | DEBIAN-CVE-2026-12216 |
| Ubuntu:22.04:LTS | duktape | no fix listed | UBUNTU-CVE-2026-12216 |
| Ubuntu:24.04:LTS | duktape | no fix listed | UBUNTU-CVE-2026-12216 |
| Ubuntu:25.10 | duktape | no fix listed | UBUNTU-CVE-2026-12216 |
| Ubuntu:26.04:LTS | duktape | no fix listed | UBUNTU-CVE-2026-12216 |
| Ubuntu:26.10 | duktape | no fix listed | UBUNTU-CVE-2026-12216 |
Affected products (as reported)
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-370859 | svaarala duktape duk_api_bytecode.c memory corruption vdb-entry, technical-description
- VDB-370859 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-12216 | CVE Analysis and Report third-party-advisory
- Submit #833814 | Duktape https://github.com/svaarala/duktape <=2.99.99 Memory Corruption third-party-advisory
- https://github.com/hmKunlun/compileOOB/blob/main/api_bytecode.md exploit