QuickJS CVE-2025-62495

Requires the attacker to control a regular-expression pattern compiled by QuickJS's libregexp, and that pattern (e.g. the recursive PoC pattern) must produce more than 2^31 bytes (~2GB) of regex bytecode so the DynBuf size_t wraps to a negative signed 32-bit int. This is the specific, concrete prerequisite - not a vague 'configuration'. Strongly limiting factors: the multi-gigabyte bytecode requirement demands substantial host memory and a deliberately crafted recursive pattern (reflected as AC:H/AT:P), and the attacker must already be able to feed JavaScript/regex into the QuickJS-embedding application. There is no special product feature or non-default setting required - the flaw is in the core regex compiler - but the sheer size needed sharply constrains realistic, reliable exploitation.

Severity is driven by memory corruption potential (OOB write, CWE-191) rather than ease of exploitation. The provided CVSS 4.0 base score is 7.1 with a vector (AV:A/AC:H/AT:P/PR:L/UI:P) whose Attack Complexity High and Attack Requirement Present flags correctly signal that this is NOT a trivially triggerable bug: the description states the bytecode buffer must exceed 2^31 bytes (~2GB) before the signed-int wrap occurs, which demands an extraordinary amount of memory and a purpose-built recursive regex. No EPSS score is present in the input, so exploitation-probability cannot be quantified - STATE EXPLICITLY: EPSS missing. It is NOT in CISA KEV, so there is no evidence of active exploitation. A POC is publicly available (Google issuetracker 434196926, reporter cve-coordination@google.com), so publicly available exploit code exists, but POC availability is distinct from active exploitation and does not imply widespread attacks. Conflicting signal to verify: the input 4.0 vector uses AV:A (adjacent/network) and UI:P (passive user interaction), which is hard to reconcile with a library-internal regex-compiler bug - in practice the attacker must already supply a pattern to the embedding application, which is typically a local/script-execution context (AV:L), so the network-adjacent framing should be verified against the actual embedding. Net: a genuine memory-safety flaw and a useful sandbox-escape primitive for an attacker who can already run JavaScript/regex in a QuickJS host, but the ~2GB bytecode precondition makes it a lower real-world priority than the 7.1 score alone suggests - closer to targeted/opportunistic than mass-exploitable.

An attacker who can submit JavaScript or a regular expression to an application embedding QuickJS crafts a deeply recursive pattern whose compiled libregexp bytecode exceeds 2GB; the size_t buffer length is truncated into a signed 32-bit int and wraps negative, so a jump-patch offset computed in re_parse_disjunction points before the buffer and put_u32 performs an out-of-bounds write into host-process memory. A public POC exists (Google issue tracker), but the multi-gigabyte memory requirement and AC:H/AT:P conditions make reliable triggering resource-intensive rather than casual.