6.3
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и след действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.
Засегнати продукти
- quickjs-ng quickjs: 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11.0
Вид слабост
История
- 10 януари 2026 Публикувано
Други уязвимости в quickjs-ng quickjs
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-0822
- https://nvd.nist.gov/vuln/detail/CVE-2026-0822
- https://vuldb.com/?id.340356
- https://vuldb.com/?ctiid.340356
- https://vuldb.com/?submit.731783
- https://github.com/quickjs-ng/quickjs/issues/1297
- https://github.com/quickjs-ng/quickjs/pull/1298
- https://github.com/quickjs-ng/quickjs/issues/1297#issue-3780006202
- https://github.com/quickjs-ng/quickjs/commit/53eefbcd695165a3bd8c584813b472cb4a69fbf5
- https://github.com/quickjs-ng/quickjs/