QuickJS CVE-2025-62492

Exploitation requires the ability to execute attacker-controlled JavaScript within an application embedding the vulnerable QuickJS engine, and the specific trigger is a call to TypedArray.prototype.indexOf() with a negative fromIndex argument whose magnitude is extremely small (e.g. -1e-20), such that floating-point addition of fromIndex+length rounds exactly to length. Limiting factors: the attacker must already be able to run script in the engine; impact is bounded to a single out-of-bounds element read (information disclosure only, no write or code execution); and whether the leak is observable and useful depends on the host environment's memory layout and how it exposes engine output. The supplied CVSS 4.0 vector additionally posits adjacent-network reach (AV:A), high complexity (AC:H), a present attack requirement (AT:P), low privileges (PR:L), and passive user interaction (UI:P), but these are deployment-dependent for an embeddable library.

This is a genuine but low-to-moderate priority issue, and the signals are mostly consistent in pointing to limited real-world risk despite the presence of public exploit code. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:L/UI:P) describes a hard-to-reach bug: adjacent network vector, high attack complexity, a present attack requirement, low privileges required, and passive user interaction - a combination that yields only a medium 5.9 score. The technical impact is inherently small: a single-element out-of-bounds read (CWE-125) yielding at most adjacent-memory information disclosure, not code execution. EPSS of 0.39% (32nd percentile) is low and aligns with the absence of a CISA KEV listing - there is no indication of active, widespread exploitation. The one elevating factor is that publicly available exploit code exists (Google issue tracker 434194797), but POC availability is a distinct signal from active exploitation and should not be conflated with it. Note a tension worth verifying: the supplied CVSS 4.0 vector rates adjacent-network delivery with user interaction (AV:A/UI:P), yet the vulnerability is in a JavaScript engine whose exploitability depends entirely on the embedding host (how untrusted script reaches the engine) - the real attack vector and privilege requirement vary by deployment and are not fixed by the vector alone. Bottom line: a real, confirmed bug with a POC, but low severity, low EPSS, and no KEV make it a patch-in-normal-cycle item rather than an emergency, unless the engine is embedded to execute untrusted script in a sensitive context.

An attacker able to run crafted JavaScript inside an application that embeds the QuickJS engine calls TypedArray.prototype.indexOf() with an extremely small negative fromIndex (e.g. -1e-20); floating-point rounding makes d+len equal len, so the search begins one element past the end of the buffer. The resulting one-element out-of-bounds read can leak adjacent heap memory contents back to the attacker's script, and public exploit code demonstrating the trigger exists.