EUVD-2026-115199
GHSA-xffc-9827-rpvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExecute attacker-supplied JavaScript on 32-bit host
-
DeliveryAllocate typed array near 2^30 elements
-
ExploitCall .sort() with comparator
-
ExecutionInteger overflow wraps index allocation size
-
PersistMerge sort writes indices past undersized heap buffer
-
ImpactHeap corruption crashes process or enables code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the QuickJS-NG build running on a 32-bit host - 64-bit platforms are unaffected because the 32-bit multiplication len * sizeof(uint32_t) does not overflow; (2) the attacker's ability to execute JavaScript within the engine; and (3) allocation of a typed array near 2^30 elements (roughly a 1 GB ArrayBuffer, e.g. new Uint8Array(new ArrayBuffer(0x40000001))) followed by a .sort() call with a comparator that reaches the merge-sort index path. Limiting factors: the 32-bit-only constraint sharply narrows the affected population, the large (~1 GB) allocation must succeed on the target, and the attacker needs JavaScript-execution capability in the embedding. Authentication requirement is PR:N per the provided vector (no privileges to run the script), with no user interaction (UI:N). |
| Impact | The input assigns a CVSS 4.0 base score of 8.3 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H. The AT:P (attack requirement present) honestly reflects the two gating preconditions confirmed in the GHSA advisory: the host must be 32-bit, and the attacker must drive a typed array to near 2^30 elements (an ~1 GB ArrayBuffer). 64-bit hosts are not affected because len * 4 does not wrap. Primary impact is availability (VA:H - reliable heap corruption/crash) with only limited confidentiality/integrity impact (VC:L/VI:L), consistent with the advisory describing a crash with potential - not demonstrated - code execution. No EPSS score and no KEV status were provided, so there is no signal of active or widespread exploitation; this is NOT confirmed actively exploited. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority. Real-world risk is therefore conditional: it is a genuine priority for anyone embedding QuickJS-NG on 32-bit targets (IoT/embedded/WASM) that execute attacker-influenced JavaScript, but materially lower for 64-bit-only deployments. Note a data conflict: the description and release say the fix is in 0.16.0 (vulnerable 'before 0.16.0'), while the package metadata line states 'vulnerable: <= 0.8.0' - the affected range should be verified against the vendor advisory. |
| Exploit ScenarioDerived | An attacker able to run JavaScript inside a 32-bit QuickJS-NG embedding (e.g., an IoT/embedded device, set-top box, or WASM sandbox) allocates a typed array near 2^30 elements and calls TypedArray.prototype.sort with a comparator, causing len * 4 to wrap to a tiny allocation while the merge sort writes len indices, corrupting the heap. The result is a crash or potentially attacker-influenced memory corruption. A public PoC reference exists (the GHSA advisory includes a reproducing snippet and the fix commit adds a regression test); it is not verified as working weaponized exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
RemediationAI
Upgrade QuickJS-NG to v0.16.0, which is the fixed release published at https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0 and is the primary remediation (vendor patch available). If an immediate version bump is not possible, backport commit e93cca611908e12b824ec85fbee6b31a5ee61568, which swaps the js_malloc(ctx, len * sizeof(array_idx[0])) call in js_typed_array_sort() for js_calloc(ctx, len, sizeof(array_idx[0])) so the allocation size is overflow-checked; this is a one-line change plus an optional regression test and carries low regression risk in the sort path. Where the engine cannot be rebuilt promptly, two compensating controls reduce exposure: confine QuickJS-NG to 64-bit builds, which are not affected because the multiplication does not wrap, at the cost of losing 32-bit footprint advantages on embedded targets; or, for 32-bit deployments, cap runtime heap via JS_SetMemoryLimit below the ~1 GB ArrayBuffer the trigger requires - the upstream regression test uses exactly this technique - with the trade-off that legitimate workloads needing large buffers will fail allocation. Restricting who may execute JavaScript in the embedding also removes the attacker prerequisite, since the flaw is only reachable from script through TypedArray.prototype.sort. Advisory guidance is at https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow (CWE-190) that results in a heap-based buffer overflow (CWE-122) in the QuickJS-NG engine's implementation of TypedArray.prototype.sort(). The merge-sort implementation allocates an auxiliary index array with js_malloc(ctx, len * sizeof(array_idx[0])); on 32-bit platforms, where size_t is 32 bits and each index is 4 bytes, a typed array length close to 2^30 makes len * 4 wrap around to a small value, so the index array is allocated undersized while the merge sort subsequently writes len entries, running past the end of the heap allocation. The upstream fix in commit e93cca611908e12b824ec85fbee6b31a5ee61568 replaces the multiply-then-allocate call with js_calloc(ctx, len, sizeof(array_idx[0])), which computes the allocation size with an overflow check, and adds an api-test regression case that allocates a 0x40000010-byte ArrayBuffer and asserts the sort raises an exception under a capped memory limit. Because the trigger lives in the JavaScript-visible typed-array API, any embedding that lets untrusted scripts run - embedded and IoT firmware, small-footprint 32-bit runtimes, and WebAssembly or other 32-bit builds where QuickJS-NG is commonly deployed - is exposed, whereas 64-bit builds are structurally unaffected because the 32-bit multiplication does not wrap. The trigger requires a successful large allocation and a comparator-driven sort; the sources do not describe heap-grooming specifics beyond the out-of-bounds write into the undersized index array.
Know when Quickjs Ng gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
AC:H captures the 32-bit-host and ~2^30-element preconditions beyond the attacker's control; PR:N/UI:N since merely running JS triggers it; impact is mainly availability (A:H) with limited C/I.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Technical POC Analysis
CWE-190 (Integer Overflow or Wraparound) at the allocation site, which produces CWE-122 (Heap-based Buffer Overflow) when the undersized buffer is filled.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-120439 is a heap buffer overflow in QuickJS-NG, a JavaScript engine embedded in various applications, affecting only 32-bit builds. Attackers who can execute JavaScript within such applications could trigger a crash or potentially achieve limited code execution, impacting availability and integrity. Leadership should prioritize patching because 32-bit deployments, though less common, may exist in embedded or legacy systems, and exploitation requires specific memory conditions but no authentication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Quickjs Ng
View allquickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overfl
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthe
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is rem
Heap buffer overflow in QuickJS-NG releases before 0.16.0 gives JavaScript code a path to memory corruption on 32-bit ho
Heap memory exhaustion in QuickJS-NG versions before 0.16.0 lets JavaScript executed by an embedding host drain the proc
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attacke
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remo
Exploit-DB