CVE-2026-0822

CVE-2026-0822 affects quickjs-ng quickjs up to 0.11.0. The issue targets the js_typed_array_sort function in quickjs.c, causing a heap-based buffer overflow. It is remotely exploitable and exploits are publicly available. Patch reference: 53eefbcd695165a3bd8c584813b472cb4a69fbf5. Remediation: app...

CVE-2024-13903

CVE-2024-13903 affects quickjs-ng QuickJS up to 0.8.0. The vulnerability targets the JS_GetRuntime function in quickjs.c (component qjs), enabling a stack-based buffer overflow. The issue can be exploited remotely. Upgrade to version 0.9.0 to address the vulnerability; the patch is identified by ...

CVE-2025-46688

CVE-2025-46688 affects quickjs-ng up to 0.9.0, with an incorrect size calculation in JS_ReadBigInt for a BigInt that leads to a heap-based buffer overflow. The vulnerability also affects QuickJS prior to 2025-04-26. Connected sources consistently describe the faulty size computation as the root c...

CVE-2025-46687

CVE-2025-46687 affects quickjs-ng up to 0.9.0. A missing length check in JS_ReadString can cause a heap-based buffer overflow, impacting QuickJS builds before 2025-04-26. This vulnerability is echoed across multiple sources (NVD, OSV, Debian/Ubuntu advisories and Nessus context), confirming the i...

CVE-2026-0821

The CVE-2026-0821 issue affects quickjs-ng/quickjs up to 0.11.0, specifically the js_typed_array_constructor in quickjs.c. The vulnerability enables a heap-based buffer overflow and can be exploited remotely. A publicly disclosed exploit exists. A patch is available (hash: c5d80831e51e48a83eab16e...

CVE-2026-1144

CVE-2026-1144 affects quickjs-ng quickjs up to version 0.11.0. The vulnerability resides in an unknown function within quickjs.c of the Atomics Ops Handler component, leading to a use-after-free condition. The issue can be exploited remotely and is accompanied by public exploits; a patch is ident...

CVE-2026-1145

CVE-2026-1145 affects quickjs-ng/quickjs up to version 0.11.0. The vulnerability resides in js_typed_array_constructor_ta in quickjs.c, enabling a heap-based buffer overflow that can be triggered remotely. Exploitation has been published; patch 53aebe66170d545bb6265906fe4324e4477de8b4 is availabl...