CVE-2025-46687

CVE-2025-46687 affects quickjs-ng up to 0.9.0. A missing length check in JS_ReadString can cause a heap-based buffer overflow, impacting QuickJS builds before 2025-04-26. This vulnerability is echoed across multiple sources (NVD, OSV, Debian/Ubuntu advisories and Nessus context), confirming the i...

CVE-2024-33263

CVE-2024-33263 affects QuickJS; the issue stems from commit 3b45d15, where an Assertion Failure can occur via JS_FreeRuntime(JSRuntime *) in quickjs.c. Public sources (NVD, OSV, Red Hat, Ubuntu/NASL) consistently describe a crash that could lead to denial of service or potential code execution pa...

CVE-2025-12745

CVE-2025-12745 affects QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. The vulnerability is in the function js_array_buffer_slice of quickjs.c and causes a buffer over-read. Exploitation is restricted to local execution; the exploit has been publicly disclosed. The CVE description and mul...