Summaryinfo

A vulnerability described as critical has been identified in quickjs-ng quickjs up to 0.11.0. Affected by this issue is the function js_typed_array_constructor_ta of the file quickjs.c. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2026-1145. The attack may be performed from remote. In addition, an exploit is available. A patch should be applied to remediate this issue. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability was found in quickjs-ng quickjs up to 0.11.0. It has been rated as critical. Affected by this issue is the function js_typed_array_constructor_ta of the file quickjs.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-1145. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 294810 (Linux Distros Unpatched Vulnerability : CVE-2026-1145), which helps to determine the existence of the flaw in a target environment.

Applying the patch 53aebe66170d545bb6265906fe4324e4477de8b4 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (294810). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• quickjs-ng

Name

• quickjs

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11.0

License

• open-source

Website

• Product: https://github.com/quickjs-ng/quickjs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #735539: quickjs-ng quickjs v0.11.0 Heap-based Buffer Overflow (by mcsky23)

Discussion