Out-of-Bounds Read Vulnerability in MicroQuickJS by Bellard
CVE-2025-71470

6.8MEDIUM

Key Information:

Vendor: Bellard
Status: MQuickjs
Vendor: CVE Published:; 15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-71470?

MicroQuickJS, prior to commit 99eed3f, is susceptible to an out-of-bounds read vulnerability. This occurs when the JS_Call() function raises exceptions during frame setup without appropriately updating the context stack pointer (ctx->sp) and frame pointer (ctx->fp). Consequently, an attacker can exploit this flaw by supplying malicious JavaScript that invokes a non-function value. This can lead to the build_backtrace() function walking through outdated frame pointers, potentially causing the engine to crash, resulting in a denial of service.

Affected Version(s)

mquickjs 0 < 99eed3f94cb66ea7e02fd3472ca7374dee31bb89

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-71470 - Proof of Concept