PT-2026-135456
CVE-2026-120440
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js atomics store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
Found an issue in the description? Have something to add? Feel free to write us 👾