CVE-2025-71470 in mquickjs
Summary
by MITRE • 11/15/2026
MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The MicroQuickJS library, specifically prior to commit 99eed3f, contains a critical out-of-bounds read vulnerability rooted in improper exception handling during JavaScript execution context management. This flaw manifests when the JS_Call function is invoked with arguments that do not constitute a valid callable entity, such as attempting to invoke a non-function value like an integer or null object. In standard operation, MicroQuickJS maintains internal pointers for the stack pointer (ctx->sp) and frame pointer (ctx->fp) to track execution state across nested calls. However, when JS_Call detects that the target is not callable, it triggers an exception mechanism but fails to correctly update these critical context variables before returning control or proceeding with error handling routines.
This inconsistency in state management leads directly to a denial of service condition through application crash. The core technical failure occurs within the build_backtrace function, which is often invoked during debugging or error reporting phases following an execution fault. Because ctx->sp and ctx->fp were not reset or adjusted appropriately after the failed call attempt, they retain stale values that point to invalid memory regions or corrupted stack frames. When build_backtrace attempts to walk these frame pointers to construct a diagnostic trace, it reads from out-of-bounds memory locations. This illegal memory access inevitably causes the JavaScript engine to terminate abruptly, resulting in a crash of any application relying on MicroQuickJS for script execution.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. The attack vector is classified under ATT&CK technique T1499, specifically Endpoint Denial of Service via Application Crashing, as an attacker can exploit this flaw by crafting malicious JavaScript payloads designed to trigger non-function invocations in controlled environments. While the primary impact observed is a crash rather than arbitrary code execution due to the read-only nature of the initial fault, such memory corruption issues often serve as precursors to more severe exploits if similar patterns exist elsewhere in the engine's memory management logic.
Mitigation strategies require immediate patching to commit 99eed3f or any subsequent version that addresses this specific state inconsistency. Developers integrating MicroQuickJS should ensure their build environments are configured to pull from secure, verified repositories rather than unpatched forks. Additionally, implementing robust input validation at the application layer can provide a secondary defense in depth by filtering out potentially malicious script structures before they reach the engine's execution core. Monitoring for unexpected process terminations or segmentation faults associated with JavaScript engines may also aid in detecting exploitation attempts of this vulnerability in production environments until patches are fully deployed.