CVE-2021-41751

What it actually does

Buffer overflow in ecma_builtin_array_prototype_object_slice allows out-of-bounds memory access during array operations in the JerryScript engine.

Why it matters to the business

Older JerryScript deployments face elevated risk of remote code execution or service crashes when processing untrusted JavaScript, potentially disrupting embedded or IoT applications that rely on the engine.

How an attack unfolds

An attacker supplies crafted JavaScript that invokes Array.prototype.slice with inputs triggering the vulnerable code path at line 909, causing memory corruption that can be leveraged for arbitrary code execution.

How to fix it

Update JerryScript to a build containing commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 or later; recompile and redeploy all dependent firmware or applications.

How to confirm the fix worked

Confirm the running binary or source tree includes the referenced commit; test with known triggering JavaScript inputs to verify absence of the overflow condition.

Typical attack path

1. Identify a target application embedding an unpatched JerryScript engine reachable over the network.
2. Deliver malicious JavaScript payload that exercises the slice function with oversized or malformed parameters.
3. Trigger buffer overflow to corrupt memory and gain control of execution flow.
4. Execute arbitrary code or cause denial of service on the affected device.

How to detect it

Review application or system logs for unexpected crashes or memory errors during JavaScript execution; examine process dumps for signs of corruption in array-handling routines.

What your security team should do

• Prioritize inventory of all JerryScript instances and schedule upgrades within standard change windows given the high CVSS and network exposure.
• Implement network segmentation or input sanitization around JavaScript execution contexts until patches are applied.
• Monitor EPSS and exploit maturity indicators for any future increase in observed activity.