CVE-2021-41752

What it actually does

Unbounded recursive calls to the new opt() function trigger a stack overflow, resulting in memory corruption that can lead to arbitrary code execution or denial of service.

Why it matters to the business

Remote attackers can fully compromise or crash embedded and IoT devices running vulnerable Jerryscript, disrupting operations and potentially allowing persistent access in widely deployed environments.

How an attack unfolds

An attacker supplies crafted JavaScript input that forces repeated recursive invocations of the opt() function, overflowing the call stack and corrupting memory to achieve code execution; public exploits are available.

How to fix it

Upgrade Jerryscript to commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 or newer; rebuild and redeploy all affected applications and firmware images.

How to confirm the fix worked

Confirm the source tree contains commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2; re-test previously crashing inputs to verify recursion depth is now bounded.

Typical attack path

1. Deliver malicious JavaScript payload over the network to a Jerryscript instance
2. Trigger unbounded recursion in the new opt() function
3. Overflow the stack and corrupt adjacent memory
4. Hijack control flow to execute attacker-supplied code or crash the process

How to detect it

Review application and system logs for unexpected Jerryscript process terminations or stack-related faults; examine network traffic for unusual JavaScript payloads targeting the engine.

What your security team should do

• Prioritize upgrade of all Jerryscript deployments within the next 30 days given public exploit availability
• Inventory downstream products and firmware that embed Jerryscript
• Implement network segmentation or input validation around JavaScript parsers until patches are applied
• Monitor for process crashes or high stack usage in Jerryscript binaries