CVE-2022-22895

What it actually does

Heap buffer overflow in ecma_utf8_string_to_number_by_radix during UTF-8 string to numeric conversion by radix, enabling out-of-bounds read/write on the heap.

Why it matters to the business

Embedded JavaScript engines in IoT, edge, or scripting applications may experience crashes or remote code execution when processing attacker-controlled input, leading to service outages or device compromise; the issue remains unpatched in listed releases with public exploit code available for over four years.

How an attack unfolds

An attacker supplies a crafted string input that reaches the vulnerable conversion routine; the malformed radix handling triggers an oversized write beyond the allocated heap buffer, allowing memory corruption that can be leveraged for arbitrary code execution given the available public exploit.

How to fix it

Upgrade to the latest JerryScript release that resolves the buffer handling flaw in ecma_utf8_string_to_number_by_radix; if no fixed release is published, apply custom patches to bounds-check the conversion buffer or disable the affected radix conversion path.

How to confirm the fix worked

Rebuild with address sanitizer or similar instrumentation and re-test the conversion function using inputs that previously triggered the overflow; confirm absence of crashes or sanitizer reports on boundary cases.

Typical attack path

1. Identify an application embedding the affected JerryScript version
2. Craft a malicious UTF-8 string designed to overflow the radix conversion buffer
3. Deliver the input through normal application channels that invoke ecma-helpers-conversion
4. Trigger heap corruption and execute attacker-controlled code or cause denial of service

How to detect it

Inspect process crash dumps or sanitizer logs for heap-buffer-overflow signatures originating from ecma-helpers-conversion.c; correlate application logs showing unexpected numeric conversion failures or memory exhaustion events around string handling.

What your security team should do

• Prioritize inventory of all JerryScript deployments given the public exploit and long disclosure window
• Apply upstream patches or backported bounds checks immediately
• Restrict untrusted input to string-to-number conversion surfaces until fixed
• Monitor vendor advisories for a future fixed release