Cpe:2.3:a:quickjs-Ng_project:quickjs-Ng:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aquickjs-ng_projectquickjs-ng/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:50:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgQuickJS-NG: Heap buffer overflow in js_proxy_get_own_property_names (CVE-2026-120438)https://feed.craftedsignal.io/briefs/2026-11-quickjs-ng-overflow/Mon, 02 Nov 2026 15:50:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-quickjs-ng-overflow/QuickJS-NG before 0.16.0 contains an integer overflow in the js_proxy_get_own_property_names function that can lead to heap buffer overflows and potential code execution on 32-bit hosts via malicious Proxy ownKeys traps.QuickJS-NG versions prior to 0.16.0 contain an integer overflow vulnerability in the js_proxy_get_own_property_names() function within quickjs.c. The vulnerability is triggered when a JavaScript Proxy object defines an ownKeys trap that returns a large array-like object. On 32-bit architectures, this leads to an integer overflow during memory allocation calculations, resulting in a heap buffer overflow. This can be leveraged to cause application crashes or arbitrary code execution.

Impact

Successful exploitation may allow for denial of service (application crashes) or arbitrary code execution in the context of the QuickJS-NG engine. The vulnerability is specifically constrained to 32-bit host environments.

Recommendation

  • Update QuickJS-NG to version 0.16.0 or later to include the fix for CVE-2026-120438.
  • Inventory environments utilizing QuickJS-NG, prioritizing 32-bit architecture deployments for immediate patching.
]]>highadvisoryvulnerabilitymemory-corruptionremote-code-execution