QuickJS-NG CVE-2026-120438

Two concrete preconditions must both hold: (1) the embedding application must execute attacker-controlled JavaScript in QuickJS-NG < 0.16.0 (the engine must evaluate untrusted script - a sandbox, plugin host, or script-driven embedded device); and (2) the host must be a 32-bit platform - the GHSA explicitly states that on 64-bit platforms the allocation size is correct and the overflow does not occur. The specific trigger is a Proxy whose ownKeys trap returns an array-like object with length near 2^32 (e.g. 0x20000000-0xffffffff), followed by Object.keys() or Object.getOwnPropertyNames() on that Proxy, which reaches js_proxy_get_own_property_names() and wraps the 32-bit count. Limiting factors beyond raw CVSS: not exploitable on 64-bit hosts; requires the ability to run JavaScript (PR:L, not anonymous network access); no user interaction required once script runs.

This is a genuine but conditionally-scoped memory-corruption flaw rather than an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H and the RCE tag reflect full triple-impact corruption, but the attack vector is LOCAL and requires PR:L - the attacker must already be able to execute JavaScript inside the embedded engine, so this is not a remote-unauthenticated internet-facing bug. The single most important limiting signal is in the source evidence, not the CVSS: the overflow only occurs on 32-bit hosts (IoT, embedded, some WASM runtimes); on 64-bit platforms the GHSA states the allocation size is correct and the overflow does not occur. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public reproducer/PoC reference exists (the vendor's own regression tests in the fix commit and the VulnCheck advisory), but it is a crash reproducer and is not verified as a working weaponized code-execution exploit. The vuln.today decision label is 'this_week', consistent with a patched, locally-exploitable RCE-class flaw that is serious where the preconditions (32-bit host + untrusted JS) hold but not an emergency for the typical 64-bit deployment. One data conflict to verify with the vendor: the CVE description says 'before 0.16.0' (fixed in 0.16.0) while the GHSA package record lists 'vulnerable: <= 0.8.0', which is an inconsistent version range.

An application embedding QuickJS-NG (< 0.16.0) on a 32-bit device evaluates attacker-supplied JavaScript. The attacker defines a Proxy whose ownKeys trap reports a length close to 2^32 and invokes Object.keys()/Object.getOwnPropertyNames() on it, wrapping the 32-bit allocation-size arithmetic so js_realloc allocates a small buffer while the copy loop writes far more entries, corrupting the heap for a crash or potential code execution. A public reproducer exists in the vendor's test suite (proxy_own_keys_huge_length / test_proxy_own_keys_huge_length), but it is a crash test, not a verified working exploit.