8.4

CVE-2025-46688

Exploit
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quickjs-ng ≫ Quickjs Version <= 0.9.0
Quickjs Project ≫ Quickjs Version < 2025-04-26
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.187
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve@mitre.org 5.6 1.4 3.7
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-131 Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

https://github.com/quickjs-ng/quickjs/issues/1018
Third Party Advisory
https://github.com/quickjs-ng/quickjs/pull/1020
Patch
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
Patch
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
Patch
https://github.com/bellard/quickjs/issues/399
Third Party Advisory
Exploit
https://bellard.org/quickjs/Changelog
Product