Integer Overflow Vulnerability in QuickJS Regular Expression Engine

CVE-2025-62495

What is CVE-2025-62495?

An integer overflow vulnerability exists in the QuickJS regular expression engine's handling of bytecode buffer sizes. When a large or complex regular expression exceeds the positive limits of a signed 32-bit integer, it can cause a wrap-around, resulting in a negative value that is used in offset calculations. This miscalculation allows for out-of-bounds writes, potentially leading to memory corruption or execution of arbitrary code.

References