CVE-2026-120438

Name of the Vulnerable Software and Affected Versions QuickJS-NG versions prior to 0.16.0

Description An integer overflow exists in the js proxy get own property names() function within the quickjs.c file, which leads to a heap buffer overflow on 32-bit hosts. This occurs when JavaScript code returns a large array-like object from a Proxy ownKeys trap, causing the allocation size to wrap. This condition can result in system crashes or potential arbitrary code execution.

Recommendations Update QuickJS-NG to version 0.16.0 or later.