This vulnerability in Cesanta mJS affects versions 1.0 through 1.26 inclusive. The flaw exists in the skip_spaces_and_comments function of src/mjs_tok.c, where a heap-based buffer overflow can occur due to improper handling of input data. The vulnerability can be triggered remotely without privileges or user interaction, potentially allowing an attacker to cause memory corruption. The issue was reported early to the project but remains unpatched as of the publication date. No official remediation or patch has been announced.

Successful exploitation of this heap-based buffer overflow could lead to memory corruption, which may result in application crashes or potentially arbitrary code execution depending on the environment and usage context. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no confirmed exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official Cesanta channels for updates. Until a patch is available, consider applying workarounds such as disabling or restricting use of the vulnerable function if feasible, or employing runtime protections like memory safety tools to mitigate exploitation risk.