Memory Reading Flaw in QuickJS Engine Affecting Multiple Versions

CVE-2025-62493

What is CVE-2025-62493?

A flaw exists in the QuickJS engine's string conversion logic for BigInt objects, arising from an inaccurate computation of the required number of digits. This issue can lead to an Out-of-Bounds Read, allowing unauthorized access and potential exposure of sensitive data stored in adjacent memory. Specifically, the logic wrongly calculates the number of digits needed, causing the engine to exceed allocated memory limits during conversion operations. As a result, attackers could exploit this issue to read memory contents that are not intended for access, leading to possible information disclosure surrounding the BigInt object.

References