CVE Feed

    Dashboard / CVE / CVE-2015-5380

    CVE-2015-5380

    The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.

    Published:Jul 3, 2015
    Last Modified:Apr 12, 2025
    EPS:Jul 9, 2015
    EPSS Score:0.00755
    CVSS Score:7.5

    Affected Products

    Vendor
    Google
    Product
    V8
    Vendor
    Iojs
    Product
    Io.js
    Vendor
    Nodejs
    Product
    Node.js

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-85046 (CVSS 8.8) — Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary co…
    CVE-2026-1862 (CVSS 8.8) — Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit…
    CVE-2025-14766 (CVSS 8.8) — Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to poten…
    CVE-2025-11215 (CVSS 4.3) — Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of …
    CVE-2025-10890 (CVSS 9.1) — Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to l…
    CVE-2025-10585 (CVSS 9.8) — Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit…
    CVE-2024-3914 (CVSS 6.5) — Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit …
    CVE-2024-1939 (CVSS 8.8) — Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit …
    CVE-2016-5128 (CVSS 8.8) — objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API …
    CVE-2016-5129 (CVSS 8.8) — Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trim…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High