Use-After-Free Vulnerability in QuickJS Engine Standard Library
CVE-2025-62491

8.8HIGH

Key Information:

Vendor

Quickjs

Status
Quickjs
Vendor
CVE Published:
16 October 2025

What is CVE-2025-62491?

A Use-After-Free vulnerability has been identified within the QuickJS engine's standard library during the management of unhandled rejected promises. This flaw occurs when the js_std_promise_rejection_check function iterates through the rejected_promise_list to handle unreported promise rejections. When the rejection reason is an Error object with a custom property getter, this getter can execute JavaScript code, including a call to catch() on the same rejection being processed. This leads to the internal removal and freeing of the promise entry from the rejection list, while the iteration continues using freed memory. This results in a potential exploit allowing attackers to execute arbitrary code or manipulate memory unexpectedly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

QuickJS 2025-04-26 < 2025-09-13

References

https://bellard.org/quickjs/Changelog
https://issuetracker.google.com/434195203

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Google Big Sleep
JSON
.