7.8

CVE-2025-46687

Exploit
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bellard ≫ Quickjs Version < 2025-04-26
Quickjs-ng ≫ Quickjs Version <= 0.9.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.159
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve@mitre.org 5.6 1.4 3.7
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://github.com/quickjs-ng/quickjs/issues/1018
Vendor Advisory
Exploit
Issue Tracking
https://github.com/quickjs-ng/quickjs/pull/1020
Patch
Issue Tracking
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
Patch
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
Patch
https://github.com/bellard/quickjs/issues/399
Vendor Advisory
Exploit
Issue Tracking
https://bellard.org/quickjs/Changelog
Release Notes