What is the CVSS score of CVE-2026-1145?

CVE-2026-1145 has a contested CVSS base score of 2.1 from a third party (e.g. CISA-ADP), while the vendor rates it Low. vuln.today uses the vendor rating as authoritative.

Which versions of Quickjs are affected by CVE-2026-1145?

Organizations using quickjs-ng quickjs should be aware of moderate risk from CVE-2026-1145, a buffer overflow vulnerability rated CVSS 6.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1145?

Yes, a public proof-of-concept exploit is available for CVE-2026-1145. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-1145?

Within 30 days: Identify affected systems running quickjs-ng quickjs and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Quickjs CVE-2026-1145

LOW

Buffer Overflow (CWE-119)

2026-01-19 cna@vuldb.com

Buffer Overflow Quickjs Quickjs Ng

Low

Disputed · 2.1 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

6.3 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 23, 2026 - 09:16 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 09:16 nvd

Patch available

CVE Published

Jan 19, 2026 - 09:16 nvd

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 53aebe66170d545bb6265906fe4324e4477de8b4. It is suggested to install a patch to address this issue.

AnalysisAI

Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remote attackers to corrupt memory and potentially achieve code execution with user interaction. Public exploit code exists for this vulnerability, increasing practical attack risk. A patch is available and should be applied immediately.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Quickjs. A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 53aebe66170d545bb6265906fe4324e4477de8b4. It is suggested to install a patch to address this issue.

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.