EUVD-2026-86272
GHSA-jww9-7qmq-6hv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted QuickJS bytecode blob
-
DeliveryApp calls JS_ReadObject with bytecode flag
-
ExploitOversized LEB128 length overflows in bc_get_sleb128
-
ExecutionHeap out-of-bounds write in JS_ReadFunctionTag
-
ImpactCorrupt heap for code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the embedding application to deserialize attacker-controlled QuickJS bytecode via JS_ReadObject with the JS_READ_OBJ_BYTECODE flag set (demonstrated in the fix's bjson.read test using the bytecode flag). This is NOT the default QuickJS usage pattern - engines typically execute JavaScript source, not serialized bytecode - so the vulnerable path is only present in apps that treat serialized bytecode as an input (plugin/cache/IPC loaders). Where that path is exposed, no authentication or user interaction is needed and a single crafted blob with an oversized LEB128 length (exceeding INT_MAX) triggers the overflow; where it is not exposed, the flaw is unreachable. Affected version is pinned to commit 04be24600 (fixed in PR #553); precise version ranges are not reliably published. |
| Impact | The raw signals look alarming - CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) for a CWE-787 heap out-of-bounds write - but the real-world picture is far narrower. EPSS is only 0.17% (5th percentile), there is no CISA KEV listing, and no public weaponized exploit was identified; the only 'exploit' artifact is the maintainer's regression test buffer in the PR #553 diff, which is a crash reproducer, not an attack tool. Crucially, the flaw lives in the QuickJS BYTECODE deserializer (JS_ReadFunctionTag via bc_get_sleb128), reachable only through the JS_READ_OBJ_BYTECODE path. QuickJS normally executes JavaScript SOURCE, not serialized bytecode, so the AV:N/PR:N framing only holds for the atypical minority of embedders that deserialize attacker-controlled bytecode blobs. The 9.8 therefore overstates typical risk: it is a genuine memory-corruption bug with RCE potential where the bytecode path is exposed, but a low real-world priority for the common source-execution deployment. Signals are consistent (low EPSS, no KEV, no in-the-wild activity) and point to a fix-in-normal-course issue rather than an urgent one. |
| Exploit ScenarioDerived | An application embeds QuickJS and passes externally-supplied serialized bytecode to JS_ReadObject with the JS_READ_OBJ_BYTECODE flag (e.g. a cache, plugin loader, or IPC channel). An attacker supplies a crafted bytecode blob with an oversized LEB128-encoded function count/length that overflows past INT_MAX, driving a heap out-of-bounds write in JS_ReadFunctionTag that can corrupt memory and potentially achieve code execution. No public exploit exists beyond the maintainer's SyntaxError regression test in PR #553. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the authoritative remediation is to apply QuickJS pull request #553, specifically changeset 42526037cfc0b2a94a875c0de0f4bbeaf597a542, which rewrites bc_get_sleb128() to read into a uint32_t, reject values greater than INT_MAX with a SyntaxError ("integer overflow while reading bytecode"), and adds a regression test (bjson_test_invalid_bytecode_count) exercising the JS_READ_OBJ_BYTECODE flag. Because no tagged release covering this commit is confirmed in the provided data, vendored/embedded copies must be patched manually by porting that diff into their quickjs.c. If patching is not immediately possible, the most effective compensating control is to eliminate the vulnerable path entirely: stop calling JS_ReadObject with JS_READ_OBJ_BYTECODE on any data that crosses a trust boundary, and treat serialized bytecode as trusted input only - the trade-off is that bytecode caching/plugin-loading features must fall back to parsing JavaScript source (slower startup, no precompiled artifacts) or be disabled. If untrusted bytecode must be accepted, wrap it in an integrity check (HMAC or signature over the serialized blob using a key the attacker cannot forge) and reject anything unsigned or over-length - the trade-off is added key management and a mandatory signing step in the producer pipeline. Running the deserializer inside a sandboxed process with memory-safe isolation (separate low-privilege worker, seccomp/WASM boundary) limits the blast radius of a successful heap corruption but does not remove the bug, and note that any bytecode reaching the process before these controls is already attacker-controlled, so input-size caps or generic firewalling are not substitutes for removing the deserialization path. Source patch details are available at https://github.com/bellard/quickjs/pull/553 and background at https://github.com/bellard/quickjs/issues/549.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QuickJS supports serializing compiled functions and objects to a compact binary format (the bjson / JS_WriteObject-JS_ReadObject mechanism), which embedding applications can use for bytecode caching, plugin loading, or inter-process transfer. That format encodes variable-length integers using LEB128, and the reader helper bc_get_sleb128() in quickjs.c read the unsigned 32-bit LEB128 result directly into a signed int32_t pointer (via a cast to uint32_t*), so a serialized value exceeding INT_MAX was accepted without validation rather than being rejected. Downstream in JS_ReadFunctionTag(), the resulting oversized/negative length is used to drive buffer reads and writes, producing a heap out-of-bounds write - the root-cause class is CWE-787 (Out-of-bounds Write), consistent with the Buffer Overflow and Memory Corruption tags. The affected code is pinned to QuickJS commit 04be24600; the CPE data supplied is unversioned (cpe:2.3:a:n/a:n/a:*), and no reliable public version ranges are published, so consumers must map the commit against their vendored copy or fork rather than relying on a semver range.
Know when Quickjs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N since bytecode can arrive over a network, but AC:H because exploitation depends on the atypical, non-default condition that the app deserializes untrusted bytecode; full memory-corruption impact retained.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
Executive ViewAI
A critical heap memory corruption vulnerability in QuickJS, the embedded JavaScript engine shipped inside many third-party and internal applications, can allow an unauthenticated remote attacker to execute arbitrary code within the host process - but only where a product deserializes attacker-supplied bytecode rather than running ordinary JavaScript source. Organizations whose applications only execute JavaScript source have no exposure; the risk is concentrated in plugin, cache, and IPC loader paths that treat serialized bytecode as untrusted input, and those paths currently have no vendor fix available. Leadership should prioritize an inventory of where QuickJS deserialization is reachable from untrusted sources, because for that narrow set of systems the potential impact is full compromise of the host process.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or refuse JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on any untrusted input; require cryptographic signature verification of serialized bytecode before deserialization; sandbox the deserializer in a low-privilege, resource-limited process separated from sensitive data and credentials; restrict network and filesystem reachability of loaders that accept serialized blobs; monitor for loader crashes and anomalous memory errors as a potential exploitation indicator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. Rated
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overfl
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthe
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is rem
QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c. Rate
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a38
A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbb
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attacke
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remo
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. Rated medium severity (CVSS 4.
Exploit-DB