CVE-2026-0822

CVE-2026-0822 affects quickjs-ng quickjs up to 0.11.0. The issue targets the js_typed_array_sort function in quickjs.c, causing a heap-based buffer overflow. It is remotely exploitable and exploits are publicly available. Patch reference: 53eefbcd695165a3bd8c584813b472cb4a69fbf5. Remediation: app...

CVE-2025-46688

CVE-2025-46688 affects quickjs-ng up to 0.9.0, with an incorrect size calculation in JS_ReadBigInt for a BigInt that leads to a heap-based buffer overflow. The vulnerability also affects QuickJS prior to 2025-04-26. Connected sources consistently describe the faulty size computation as the root c...

CVE-2026-1144

CVE-2026-1144 affects quickjs-ng quickjs up to version 0.11.0. The vulnerability resides in an unknown function within quickjs.c of the Atomics Ops Handler component, leading to a use-after-free condition. The issue can be exploited remotely and is accompanied by public exploits; a patch is ident...

CVE-2026-1145

CVE-2026-1145 affects quickjs-ng/quickjs up to version 0.11.0. The vulnerability resides in js_typed_array_constructor_ta in quickjs.c, enabling a heap-based buffer overflow that can be triggered remotely. Exploitation has been published; patch 53aebe66170d545bb6265906fe4324e4477de8b4 is availabl...