Heap Buffer Overflow Vulnerability in QuickJS-NG by QuickJS
CVE-2026-120439

8.3HIGH

Key Information:

Vendor

Quickjs-ng

Status
Quickjs-ng
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120439?

QuickJS-NG versions earlier than 0.16.0 are susceptible to a heap buffer overflow due to an integer overflow in the js_typed_array_sort() function. This vulnerability allows attackers with the ability to execute JavaScript to exploit the TypedArray.prototype.sort method on a typed array containing close to 2^30 elements. As a result of this exploitation, the allocation size can wrap, leading to indices being written beyond the allocated buffer. This can result in a crash of the application or potentially enable arbitrary code execution in the affected environment.

Affected Version(s)

QuickJS-NG 0 < 0.16.0

References

https://github.com/quickjs-ng/quickjs/security/advisories...
vendor-advisory
https://github.com/quickjs-ng/quickjs/commit/e93cca611908...
patch
https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0
release-notes

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
Saúl Ibarra Corretgé
.