Use-After-Free Vulnerability in QuickJS Affects Multiple Array and Object Operations

CVE-2025-62490

What is CVE-2025-62490?

In QuickJS, a vulnerability exists in the js_print_object function where printing an array can lead to a use-after-free condition. Initially, the function retrieves the array length and iterates through it; however, if an attacker-defined callback is executed during the js_print_value process, it may resize the array, causing the iteration index to exceed its bounds. Additionally, a similar issue arises in map or set object printing, as elements can be removed from the ms->records list during js_print_value calls, creating unexpected behaviors and potential exploitation scenarios.

References