Use-After-Free Vulnerability in QuickJS Affects Multiple Array and Object Operations

CVE-2025-62490

What is CVE-2025-62490?

In QuickJS, a vulnerability exists in the js_print_object function where printing an array can lead to a use-after-free condition. Initially, the function retrieves the array length and iterates through it; however, if an attacker-defined callback is executed during the js_print_value process, it may resize the array, causing the iteration index to exceed its bounds. Additionally, a similar issue arises in map or set object printing, as elements can be removed from the ms->records list during js_print_value calls, creating unexpected behaviors and potential exploitation scenarios.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References