CVE-2025-46688

Опубликовано: 27 апр. 2025

Источник: nvd

CVSS3: 5.6

CVSS3: 8.4

EPSS Низкий

Описание

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Ссылки

https://bellard.org/quickjs/Changelog
Product
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
Patch
https://github.com/bellard/quickjs/issues/399
Exploit
Third Party Advisory
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
Patch
https://github.com/quickjs-ng/quickjs/issues/1018
Third Party Advisory
https://github.com/quickjs-ng/quickjs/pull/1020
Patch
https://github.com/quickjs-ng/quickjs/issues/1018
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:*

Версия до 0.9.0 (включая)

cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*

Версия до 2025-04-26 (исключая)

EPSS

Процентиль: 4%

0.00022

Низкий

5.6 Medium

CVSS3

8.4 High

CVSS3

Дефекты

CWE-131

Связанные уязвимости

CVE-2025-46688

CVSS3: 5.6

ubuntu

около 2 месяцев назад

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

CVE-2025-46688

CVSS3: 5.6

debian

около 2 месяцев назад

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadB ...

GHSA-2qc3-w5w6-7r8m

CVSS3: 5.6

github

около 2 месяцев назад

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

EPSS

Процентиль: 4%

0.00022

Низкий

5.6 Medium

CVSS3

8.4 High

CVSS3

Дефекты

CWE-131