Integer Overflow Vulnerability in QuickJS Engine's BigInt Parsing Logic

CVE-2025-62496

What is CVE-2025-62496?

A vulnerability in the QuickJS engine's BigInt string parsing logic can lead to integer overflow when processing extremely large digit strings. The issue arises in the js_bigint_from_string function, where the calculation of bits necessary for storage can exceed the limits of a signed 32-bit integer. This results in an improper estimation of the number of memory 'limbs' required for the BigInt object. Consequently, the actual memory allocation may be insufficient, leading to a Heap Out-of-Bounds Write when the engine attempts to write data into the allocated structure. This poses significant security risks as it can be exploited to manipulate memory, potentially leading to arbitrary code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

wiz.io

CVE-2025-62496

CVE-2025-62496 Impact, Exploitability, and Mitigation Steps | Wiz

Understand the critical aspects of CVE-2025-62496 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

References