What is the CVSS score of CVE-2026-0822?

CVE-2026-0822 has a contested CVSS base score of 2.1 from a third party (e.g. CISA-ADP), while the vendor rates it Low. vuln.today uses the vendor rating as authoritative.

Which versions of Quickjs are affected by CVE-2026-0822?

Organizations using quickjs-ng quickjs should be aware of moderate risk from CVE-2026-0822, a buffer overflow vulnerability rated CVSS 6.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-0822?

Yes, a public proof-of-concept exploit is available for CVE-2026-0822. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-0822?

Within 30 days: Identify affected systems running quickjs-ng quickjs and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Quickjs CVE-2026-0822

LOW

Buffer Overflow (CWE-119)

2026-01-10 cna@vuldb.com

Buffer Overflow Quickjs Quickjs Ng

Low

Disputed · 2.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

6.3 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 23, 2026 - 09:16 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 09:16 nvd

Patch available

CVE Published

Jan 10, 2026 - 14:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attackers to corrupt memory and potentially achieve code execution with minimal user interaction. Public exploit code exists for this vulnerability. Users should apply the available patch (commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5) to remediate the risk.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Quickjs. A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.