RUSTSEC-2026-0236 A `BigInt` division panics, and two neighbouring operations answer wrongly in silence

viperjs is a JavaScript engine intended to run untrusted script inside a host application, so script text is data rather than a trusted caller and a panic reachable from script is a denial of service in the embedder's process. A divisor whose magnitude lands exactly on the engine's internal limb...

A `BigInt` division panics, and two neighbouring operations answer wrongly in silence

viperjs is a JavaScript engine intended to run untrusted script inside a host application, so script text is data rather than a trusted caller and a panic reachable from script is a denial of service in the embedder's process. A divisor whose magnitude lands exactly on the engine's internal limb...

📄 V8 Sandbox Bypass: BigInt Division Memory Corruption

This is a variant of crbug.com/474041332. The issue there was that MultiplyFFT, an optimized version of integer multiplication for very large inputs, is not robust against concurrent modification of its input buffers, but was called from ProcessorImpl::FromStringLarge with a temporary buffer insi...

mruby:mruby_fuzzer: Stack-use-after-return in udiv

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5341554870124544 Project: mruby Fuzzing Engine: afl Fuzz Target: mrubyfuzzer Job Type: aflasanmruby Platform Id: linux Crash Type: Stack-use-after-return READ 4 Crash Address: 0x7fc147404084 Crash State...

mruby:mruby_proto_fuzzer: Heap-buffer-overflow in udiv

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5261682607259648 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyprotofuzzer Job Type: libfuzzerasanmruby Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...