CVE-2025-46688

Name
CVE-2025-46688
Description
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://bellard.org/quickjs/Changelog
cve@mitre.org https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
cve@mitre.org https://github.com/bellard/quickjs/issues/399
cve@mitre.org https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
cve@mitre.org https://github.com/quickjs-ng/quickjs/issues/1018
cve@mitre.org https://github.com/quickjs-ng/quickjs/pull/1020

Match rules

CPE URI Source package Min version Max version
quickjs >= 0 < 2025-04-26
cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* quickjs >= None <= 0.9.0
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* quickjs >= None < 2025-04-26

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
quickjs edge-community 2021-03-27-r5 None possibly vulnerable
quickjs edge-community 0.20250913-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
quickjs edge-community 0.20250426-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
quickjs edge-community 0.20240113-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
quickjs 3.23-community 0.20250426-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
quickjs 3.22-community 2021-03-27-r5 None possibly vulnerable
quickjs 3.22-community 0.20250426-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
quickjs 3.22-community 0.20240113-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable