Type Confusion Vulnerability in QuickJS Engine Affecting Multiple Versions

CVE-2025-62494

What is CVE-2025-62494?

A type confusion vulnerability exists in the QuickJS engine's handling of string addition operations. The issue arises when the left-hand operand is verified as a string while the right-hand operand undergoes conversion that can allow an attacker to modify the type of the left operand during execution. This change creates a mismatch that leads to improper handling within the concatenation logic. Such discrepancies may result in out-of-bounds memory access, ultimately exposing systems to memory corruption and potential arbitrary code execution within the QuickJS runtime.

References