CVE-2025-46687

CVE-2025-46687 affects quickjs-ng up to 0.9.0. A missing length check in JS_ReadString can cause a heap-based buffer overflow, impacting QuickJS builds before 2025-04-26. This vulnerability is echoed across multiple sources (NVD, OSV, Debian/Ubuntu advisories and Nessus context), confirming the i...

CVE-2025-12745

CVE-2025-12745 affects QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. The vulnerability is in the function js_array_buffer_slice of quickjs.c and causes a buffer over-read. Exploitation is restricted to local execution; the exploit has been publicly disclosed. The CVE description and mul...