CVE-2026-120439

Name of the Vulnerable Software and Affected Versions QuickJS-NG versions prior to 0.16.0

Description An integer overflow exists in the js typed array sort() function within quickjs.c. On 32-bit hosts, an attacker capable of executing JavaScript can trigger a heap buffer overflow by calling TypedArray.prototype.sort with a comparator on a typed array containing approximately 2^30 elements. This causes the allocation size to wrap, leading to indices being written beyond the buffer, which may result in a system crash or potential code execution.

Recommendations Update to version 0.16.0 or later.