CVE-2026-120439 in QuickJS-NG
Summary
by MITRE • 11/02/2026
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in QuickJS-NG prior to version 0.16.0 represents a critical memory safety flaw rooted in integer arithmetic within the JavaScript engine's array sorting implementation. Specifically, the defect resides in the js_typed_array_sort function located in quickjs.c. This component is responsible for handling sort operations on TypedArray objects, which are binary data structures used to represent raw binary data buffers such as images or audio samples. The core technical issue arises when an attacker provides a comparator function alongside a typed array that contains approximately 2^30 elements. In this scenario, the internal logic of the sorting algorithm performs calculations involving indices and allocation sizes that exceed the maximum value representable by a signed 32-bit integer. Because the underlying C implementation relies on standard integer types for memory management operations, this arithmetic operation results in an integer overflow. The calculated size wraps around to a significantly smaller positive number rather than triggering an exception or error condition as expected from safe coding practices.
This integer overflow directly leads to a heap buffer overflow during the execution of the sort algorithm. When the engine attempts to allocate memory for temporary storage required by the sorting process, it requests a buffer based on the wrapped-around size instead of the actual large size needed. Consequently, the allocated heap region is far too small to hold all the index data or intermediate values generated during the comparison and swapping phases. As the algorithm proceeds, it writes indices past the end of this undersized allocation into adjacent memory regions. This out-of-bounds write corrupts the heap metadata or overwrites neighboring objects in memory. On 32-bit hosts, where pointer sizes are smaller and address space is more constrained, this corruption is particularly exploitable because the attacker can often predict the layout of memory structures with greater precision compared to 64-bit environments.
The operational impact of this vulnerability is severe, encompassing both denial of service and arbitrary code execution. If an untrusted user or script triggers this condition, the immediate result is typically a crash due to segmentation faults caused by writing into protected memory pages or corrupting critical heap structures that prevent further allocation. However, in more sophisticated attack scenarios, the heap buffer overflow allows for precise control over adjacent memory contents. By carefully crafting the input data and comparator function, an attacker can overwrite pointers or function return addresses stored on the heap. This capability enables the execution of arbitrary machine code within the context of the process running QuickJS-NG. Since JavaScript engines are frequently embedded in web browsers, servers, and IoT devices, this vulnerability poses a significant risk to any application that processes untrusted scripts containing large typed arrays with custom sort comparators.
From a classification perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound, which describes the error resulting from arithmetic operations producing values outside the range of the destination type without proper handling. Furthermore, it falls under CWE-787 Out-of-bounds Write, as the root cause is writing data beyond the allocated buffer boundary due to incorrect size calculation. In terms of adversary tactics, this vulnerability facilitates exploitation techniques described in MITRE ATT&CK such as T1203 Exploitation for Client Execution or T1059 Command and Scripting Interpreter if used within a browser context to execute payloads via script injection. The attack vector is classified as local execution requiring user interaction or remote code execution depending on the deployment environment, but fundamentally relies on the ability to run JavaScript with specific array parameters.
Mitigation strategies must focus primarily on upgrading the QuickJS-NG engine to version 0.16.0 or later, where this integer overflow has been addressed by implementing proper bounds checking and using wider integer types for size calculations during memory allocation. For environments that cannot immediately upgrade, defensive coding practices within host applications should include validating the length of typed arrays before passing them to sorting functions if possible, although complete prevention is difficult without engine-level fixes. Additionally, enabling heap hardening features such as ASLR (Address Space Layout Randomization) and DEP/NX (Data Execution Prevention/No-eXecute) can mitigate the likelihood of successful code execution by making it harder for attackers to predict memory layouts or execute injected shellcode. Regular security audits of JavaScript engines used in production environments are essential to identify similar arithmetic flaws before they can be leveraged in real-world attacks.