CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-46688: quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before...

5.6 CVSS

Description

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Classification

CVE ID: CVE-2025-46688

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.6

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Problem Types

CWE-131 Incorrect Calculation of Buffer Size

Affected Products

Vendor: QuickJS Project

Product: QuickJS

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.02% (probability of being exploited)

EPSS Percentile: 2.64% (scored less or equal to compared to others)

EPSS Date: 2025-05-26 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-46688
https://github.com/quickjs-ng/quickjs/issues/1018
https://github.com/quickjs-ng/quickjs/pull/1020
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
https://github.com/bellard/quickjs/issues/399
https://bellard.org/quickjs/Changelog

Timeline