QuickJS-NG: Heap buffer overflow in js_proxy_get_own_property_names (CVE-2026-120438)

QuickJS-NG versions prior to 0.16.0 contain an integer overflow vulnerability in the js_proxy_get_own_property_names() function within quickjs.c. The vulnerability is triggered when a JavaScript Proxy object defines an ownKeys trap that returns a large array-like object. On 32-bit architectures, this leads to an integer overflow during memory allocation calculations, resulting in a heap buffer overflow. This can be leveraged to cause application crashes or arbitrary code execution.

Impact

Successful exploitation may allow for denial of service (application crashes) or arbitrary code execution in the context of the QuickJS-NG engine. The vulnerability is specifically constrained to 32-bit host environments.

Recommendation

• Update QuickJS-NG to version 0.16.0 or later to include the fix for CVE-2026-120438.
• Inventory environments utilizing QuickJS-NG, prioritizing 32-bit architecture deployments for immediate patching.