quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt…
Priority HIGH 70CWE-131Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.
Summary
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed QuickJS (QuickJS Project): 2025-04-26
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QuickJS | QuickJS | before 2025-04-26 | 2025-04-26 | Patch available | CNA |
- QuickJS VendorQuickJS Affected before 2025-04-26 Fixed in 2025-04-26 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* | up to 0.9.0 | Vulnerable | quickjs-ng |
| cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* | before 2025-04-26 | Vulnerable | QuickJS |
- cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* Versions up to 0.9.0 Vulnerable ·quickjs-ng
- cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* Versions before 2025-04-26 Vulnerable ·QuickJS
Remediation
- Fix · CNA QuickJS (QuickJS Project) Fixed in 2025-04-26
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
QuickJS 2025-04-26
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2025-29365 Resource allocation without limits in QuickJSPriority HIGH 67
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46688
- 2026-10-03 Alias added: GHSA-2qc3-w5w6-7r8m
References
Patch 3
More Quickjs vulnerabilities
- TI-2025-38733 Use-after-free in js_std_promise_rejection_check in QuickJS CVSS 4.0HIGH 8.8
- TI-2025-42911 A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit… CVSS 3.1HIGH 7.5
- TI-2025-38738 Integer overflow in js_bigint_from_string in QuickJS CVSS 4.0HIGH 7.1
- TI-2025-38737 Type confusion in string addition in QuickJS CVSS 4.0HIGH 7.1
- TI-2025-38736 Type confusion in string addition in QuickJS CVSS 4.0HIGH 7.1
- TI-2023-15270 QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. CVSS 3.1HIGH 7.5
Sources
- CVE-2025-46688 · CVE Program
- CVE-2025-46688 · NVD
- FIRST EPSS
- GHSA-2qc3-w5w6-7r8m · GitHub Advisory Database · CC BY 4.0
- CVE-2025-46688 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences