Integer Overflow Vulnerability in QuickJS Engine's BigInt Parsing Logic

CVE-2025-62496

What is CVE-2025-62496?

A vulnerability in the QuickJS engine's BigInt string parsing logic can lead to integer overflow when processing extremely large digit strings. The issue arises in the js_bigint_from_string function, where the calculation of bits necessary for storage can exceed the limits of a signed 32-bit integer. This results in an improper estimation of the number of memory 'limbs' required for the BigInt object. Consequently, the actual memory allocation may be insufficient, leading to a Heap Out-of-Bounds Write when the engine attempts to write data into the allocated structure. This poses significant security risks as it can be exploited to manipulate memory, potentially leading to arbitrary code execution.

References