{"id":"CVE-2025-71470","kind":"vulnerability","aliases":["CVE-2025-71470"],"related":[],"title":"MicroQuickJS: out-of-bounds read lets attacker-supplied JavaScript crash the engine","description":"MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.","summary":"MicroQuickJS (mquickjs) before commit 99eed3f raises exceptions in JS_Call() without updating the stack and frame pointers, so building a backtrace reads stale frames. An attacker who supplies JavaScript that calls a non-function value can crash the engine, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-javascript","microquickjs","mquickjs","runtime"],"not_affected_if":["engine-not-embedded","no-untrusted-js"],"how_to_check":"- Check whether your project embeds MicroQuickJS or mquickjs (look for the mquickjs source or dependency).\n- Compare the commit you build against `99eed3f`; builds from before that commit are the ones described.\n- Confirm whether your service runs untrusted JavaScript through the engine.","fix":"Upgrade to a commit at or after `99eed3f`, per the linked patch.","status":"open","published_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","triaged_at":"2026-11-15T16:37:11+00:00","updated_at":"2026-11-15T16:37:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-15T16:37:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to a commit at or after `99eed3f`, per the linked patch.","reach":"unknown","title":"MicroQuickJS: out-of-bounds read lets attacker-supplied JavaScript crash the engine","impact":"low","summary":"MicroQuickJS (mquickjs) before commit 99eed3f raises exceptions in JS_Call() without updating the stack and frame pointers, so building a backtrace reads stale frames. An attacker who supplies JavaScript that calls a non-function value can crash the engine, causing denial of service.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["mquickjs","microquickjs","embedded-javascript"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker crashes the JavaScript engine, causing denial of service.","analyst_note":"","how_to_check":"- Check whether your project embeds MicroQuickJS or mquickjs (look for the mquickjs source or dependency).\n- Compare the commit you build against `99eed3f`; builds from before that commit are the ones described.\n- Confirm whether your service runs untrusted JavaScript through the engine.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-js","engine-not-embedded"],"who_is_affected":"Only applications that embed MicroQuickJS (mquickjs) before commit 99eed3f and execute JavaScript that an attacker can supply. The sources do not give a released version number, so the fixed reference is the commit itself. Teams that run only trusted scripts or do not embed the engine can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4627,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':16A,19A '-71470':17A,20A '99eed3f':31B,75C 'attack':9A,52B,99C 'attacker-suppli':8A 'backtrac':47B,112C 'bound':5A,81C 'build':45B,111C 'call':36B,57B,86C,104C 'caus':67B,110C 'commit':30B,74C 'contain':76C 'crash':12A,64B,119C 'ctx':94C,97C 'cve':15A,18A 'denial':68B,123C 'embed':22B 'embedded-javascript':21B 'engin':14A,66B,121C 'except':33B,88C 'fp':98C 'frame':42B,50B,90C,116C 'function':61B,108C 'javascript':11A,23B,55B,102C 'js':35B,85C 'let':7A 'microquickj':1A,24B,27B,71C 'mquickj':25B,28B,72C 'non':60B,107C 'non-funct':59B,106C 'out-of-bound':2A,78C 'pointer':43B,117C 'rais':32B,87C 'read':6A,48B,82C 'runtim':26B 'servic':70B,125C 'setup':91C 'sp':95C 'stack':40B 'stale':49B,115C 'suppli':10A,54B,101C 'updat':38B,93C 'valu':62B,109C 'vulner':83C 'walk':114C 'without':37B,92C","nicknames":[],"mitigations":[],"who_affected":"Only applications that embed MicroQuickJS (mquickjs) before commit 99eed3f and execute JavaScript that an attacker can supply. The sources do not give a released version number, so the fixed reference is the commit itself. Teams that run only trusted scripts or do not embed the engine can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedjavascript","medium","microquickjs","mquickjs","runtime"],"campaign_type":null,"search_a":"'-2025':16A,19A '-71470':17A,20A 'attack':9A 'attacker-suppli':8A 'bound':5A 'crash':12A 'cve':15A,18A 'engin':14A 'javascript':11A 'let':7A 'microquickj':1A 'out-of-bound':2A 'read':6A 'suppli':10A","search_b":"'99eed3f':31B 'attack':52B 'backtrac':47B 'build':45B 'call':36B,57B 'caus':67B 'commit':30B 'crash':64B 'denial':68B 'embed':22B 'embedded-javascript':21B 'engin':66B 'except':33B 'frame':42B,50B 'function':61B 'javascript':23B,55B 'js':35B 'microquickj':24B,27B 'mquickj':25B,28B 'non':60B 'non-funct':59B 'pointer':43B 'rais':32B 'read':48B 'runtim':26B 'servic':70B 'stack':40B 'stale':49B 'suppli':54B 'updat':38B 'valu':62B 'without':37B","search_c":"'99eed3f':75C 'attack':99C 'backtrac':112C 'bound':81C 'build':111C 'call':86C,104C 'caus':110C 'commit':74C 'contain':76C 'crash':119C 'ctx':94C,97C 'denial':123C 'engin':121C 'except':88C 'fp':98C 'frame':90C,116C 'function':108C 'javascript':102C 'js':85C 'microquickj':71C 'mquickj':72C 'non':107C 'non-funct':106C 'out-of-bound':78C 'pointer':117C 'rais':87C 'read':82C 'servic':125C 'setup':91C 'sp':95C 'stale':115C 'suppli':101C 'updat':93C 'valu':109C 'vulner':83C 'walk':114C 'without':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T16:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71470","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71470","severity":null,"published_at":"2026-11-15T16:16:56+00:00","modified_at":"2026-11-15T16:16:56+00:00","first_seen_at":"2026-11-15T16:35:37+00:00","fetched_at":"2026-11-15T16:35:37+00:00","note":null}],"documents":[{"id":164386,"url":"https://github.com/bellard/mquickjs/commit/99eed3f94cb66ea7e02fd3472ca7374dee31bb89","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":164387,"url":"https://www.vulncheck.com/advisories/microquickjs-before-commit-99eed3f-out-of-bounds-read-in-build-backtrace","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}