CVEvulnerability

CVE-2025-46687

7.8 HIGH Published 2025-04-27 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-04-27
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.6 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-770

Description

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Affected configurations

• bellard quickjs (< 2025-04-26) • quickjs-ng quickjs (<= 0.9.0)

Weakness · CWE (1)

CWE-770 Allocation of Resources Without Limits or Throttling weakness

Referenced by CWE · observed example (4)

CWE-122 Heap-based Buffer Overflow weakness
CWE-1284 Improper Validation of Specified Quantity in Input weakness
CWE-131 Incorrect Calculation of Buffer Size weakness
CWE-190 Integer Overflow or Wraparound weakness

References

https://bellard.org/quickjs/Changelog Release Notes
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a Patch
https://github.com/bellard/quickjs/issues/399 Exploit, Issue Tracking, Vendor Advisory
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465 Patch
https://github.com/quickjs-ng/quickjs/issues/1018 Exploit, Issue Tracking, Vendor Advisory
https://github.com/quickjs-ng/quickjs/pull/1020 Issue Tracking, Patch