{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aquickjs-ng_projectquickjs-ng/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:quickjs-ng:quickjs-ng:*:*:*:*:*:*:*:*","cpe:2.3:a:quickjs-ng_project:quickjs-ng:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-120438"},{"cvss":7,"id":"CVE-2026-120439"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["QuickJS-NG (\u003c 0.16.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["QuickJS-NG"],"content_html":"\u003cp\u003eQuickJS-NG versions prior to 0.16.0 contain an integer overflow vulnerability in the \u003ccode\u003ejs_proxy_get_own_property_names()\u003c/code\u003e function within \u003ccode\u003equickjs.c\u003c/code\u003e. The vulnerability is triggered when a JavaScript Proxy object defines an \u003ccode\u003eownKeys\u003c/code\u003e trap that returns a large array-like object. On 32-bit architectures, this leads to an integer overflow during memory allocation calculations, resulting in a heap buffer overflow. This can be leveraged to cause application crashes or arbitrary code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow for denial of service (application crashes) or arbitrary code execution in the context of the QuickJS-NG engine. The vulnerability is specifically constrained to 32-bit host environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate QuickJS-NG to version 0.16.0 or later to include the fix for CVE-2026-120438.\u003c/li\u003e\n\u003cli\u003eInventory environments utilizing QuickJS-NG, prioritizing 32-bit architecture deployments for immediate patching.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:50:45Z","date_published":"2026-11-02T15:50:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-quickjs-ng-overflow/","summary":"QuickJS-NG before 0.16.0 contains an integer overflow in the js_proxy_get_own_property_names function that can lead to heap buffer overflows and potential code execution on 32-bit hosts via malicious Proxy ownKeys traps.","title":"QuickJS-NG: Heap buffer overflow in js_proxy_get_own_property_names (CVE-2026-120438)","url":"https://feed.craftedsignal.io/briefs/2026-11-quickjs-ng-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:quickjs-Ng_project:quickjs-Ng:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}