QuickJS-NG EUVD-2026-115200

Requires the attacker to execute arbitrary JavaScript inside an application that embeds QuickJS-NG; it is not exploitable against an engine that does not run untrusted scripts. The concrete trigger is a BigInt64Array or BigUint64Array backed by a SharedArrayBuffer (or a resizable ArrayBuffer) and a call to Atomics.store whose value argument carries a valueOf callback that detaches the buffer (ab.transfer()) or shrinks it (ab.resize(0)) during the JS_ToBigInt64 conversion, causing the converted BigInt to leak when the function returns the RangeError/TypeError. Limiting factors: impact is only gradual memory exhaustion that needs many iterations in a long-running process, there is no confidentiality or integrity impact and no code execution, and versions at or after 0.16.0 are not affected.

This is a moderate-severity denial-of-service issue (vendor CVSS 4.0 6.9, VA:L only) and should be treated as a scheduled fix rather than an emergency, consistent with the 'this_month' decision label. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates no special complexity or privileges once an attacker can run JavaScript in the engine, and the included regression test confirms the trigger is a deterministic valueOf side effect rather than a timing-sensitive race, so AC:L is well supported. However, real-world exposure is gated entirely by whether the embedding application runs attacker-controlled JavaScript - that is the true threat model, not a network service exploitable by default. No KEV listing and no EPSS score are provided in the input, so there is no signal of active or widespread exploitation; a public PoC reference exists only as the vendor's regression test, which demonstrates the fault path but is not verified as a weaponized exploit. Note a mechanism discrepancy: the GHSA 'Attack Path' text describes a concurrent worker/race condition, whereas the CVE description and the shipped test show a single-threaded valueOf that detaches (transfer) or shrinks (resize) the buffer - the deterministic valueOf path is the better-supported reading. Net: a genuine but bounded DoS, worth patching promptly where untrusted JS is executed, but not a high-urgency, broadly-exploitable flaw.

An application that embeds QuickJS-NG to run untrusted or attacker-supplied JavaScript (e.g. a server-side scripting sandbox or an IoT device) is targeted. The attacker repeatedly calls Atomics.store on a BigInt64Array/BigUint64Array whose backing buffer is detached or resized to zero inside a valueOf callback, leaking one BigInt allocation per RangeError until the long-running process exhausts memory. The vendor's regression test demonstrates the exact trigger, but no weaponized exploit is confirmed in the available data.