Live › vulnerability › CVE-2026-120439
QuickJS-NG before 0.16.0 has an integer overflow in js_typed_array_sort() that wraps an allocation size on 32-bit hosts. A script calling TypedArray.prototype.sort with a comparator on a huge typed array can write past a heap buffer, crashing the engine or possibly running code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams embedding QuickJS-NG before 0.16.0 on 32-bit hosts, especially where untrusted JavaScript can run. Systems on 64-bit hosts or that run only trusted scripts are less exposed. The sources do not say whether other QuickJS builds are affected.
No product ranges from the sources yet.
package.json or vendored quickjs.c, against 0.16.0.0.16.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-120439")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.