CVE-2025-62495

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62495", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2025-10-15T08:47:41.878Z", "datePublished": "2025-10-16T15:51:58.953Z", "dateUpdated": "2025-10-16T17:42:15.865Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://bellard.org/quickjs/", "defaultStatus": "unaffected", "packageName": "libregexp", "product": "QuickJS", "vendor": "QuickJS", "versions": [{"lessThan": "2025-09-13", "status": "affected", "version": "2025-04-26", "versionType": "date"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "datePublic": "2025-07-24T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An integer overflow vulnerability exists in the QuickJS regular expression engine (<code>libregexp</code>) due to an <b>inconsistent representation of the bytecode buffer size</b>.</p><ol><li><p>The regular expression bytecode is stored in a <code>DynBuf</code> structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its <code>size</code> member.</p></li><li><p>However, several functions, such as <code>re_emit_op_u32</code> and other internal parsing routines, incorrectly cast or store this <code>DynBuf</code> $\\text{size}\\_\\text{t}$ value into a signed <b>int</b> (typically 32-bit).</p></li><li><p>When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed <b>$2^{31}$ bytes</b> (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a <b>negative integer</b> when stored in the <code>int</code> variable (Integer Overflow).</p></li><li><p>This negative value is subsequently used in offset calculations. For example, within functions like <code>re_parse_disjunction</code>, the negative size is used to compute an offset (<code>pos</code>) for patching a jump instruction.</p></li><li><p>This negative offset is then incorrectly added to the buffer pointer (<code>s-&gt;byte\\_code.buf + pos</code>), leading to an <b>out-of-bounds write</b> on the first line of the snippet below:</p><blockquote><p><code>put_u32(s-&gt;byte_code.buf + pos, len);</code></p></blockquote></li></ol><br>"}], "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n * This negative offset is then incorrectly added to the buffer pointer (s->byte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s->byte_code.buf + pos, len);"}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-16T15:51:58.953Z"}, "references": [{"url": "https://bellard.org/quickjs/Changelog"}, {"url": "https://issuetracker.google.com/434196926"}], "source": {"discovery": "UNKNOWN"}, "title": "Type confusion in string addition in QuickJS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-16T17:40:14.439633Z", "id": "CVE-2025-62495", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T17:42:15.865Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62495", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-16T17:40:14.439633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-16T17:41:50.821Z"}}], "cna": {"title": "Type confusion in string addition in QuickJS", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "QuickJS", "product": "QuickJS", "versions": [{"status": "affected", "version": "2025-04-26", "lessThan": "2025-09-13", "versionType": "date"}], "packageName": "libregexp", "collectionURL": "https://bellard.org/quickjs/", "defaultStatus": "unaffected"}], "datePublic": "2025-07-24T22:00:00.000Z", "references": [{"url": "https://bellard.org/quickjs/Changelog"}, {"url": "https://issuetracker.google.com/434196926"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n * This negative offset is then incorrectly added to the buffer pointer (s->byte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s->byte_code.buf + pos, len);", "supportingMedia": [{"type": "text/html", "value": "<p>An integer overflow vulnerability exists in the QuickJS regular expression engine (<code>libregexp</code>) due to an <b>inconsistent representation of the bytecode buffer size</b>.</p><ol><li><p>The regular expression bytecode is stored in a <code>DynBuf</code> structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its <code>size</code> member.</p></li><li><p>However, several functions, such as <code>re_emit_op_u32</code> and other internal parsing routines, incorrectly cast or store this <code>DynBuf</code> $\\text{size}\\_\\text{t}$ value into a signed <b>int</b> (typically 32-bit).</p></li><li><p>When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed <b>$2^{31}$ bytes</b> (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a <b>negative integer</b> when stored in the <code>int</code> variable (Integer Overflow).</p></li><li><p>This negative value is subsequently used in offset calculations. For example, within functions like <code>re_parse_disjunction</code>, the negative size is used to compute an offset (<code>pos</code>) for patching a jump instruction.</p></li><li><p>This negative offset is then incorrectly added to the buffer pointer (<code>s-&gt;byte\\_code.buf + pos</code>), leading to an <b>out-of-bounds write</b> on the first line of the snippet below:</p><blockquote><p><code>put_u32(s-&gt;byte_code.buf + pos, len);</code></p></blockquote></li></ol><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-10-16T15:51:58.953Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62495", "state": "PUBLISHED", "dateUpdated": "2025-10-16T17:42:15.865Z", "dateReserved": "2025-10-15T08:47:41.878Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2025-10-16T15:51:58.953Z", "assignerShortName": "Google"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"collectionURL": "https://bellard.org/quickjs/", "defaultStatus": "unaffected", "packageName": "libregexp", "product": "QuickJS", "vendor": "QuickJS", "versions": [{"lessThan": "2025-09-13", "status": "affected", "version": "2025-04-26", "versionType": "date"}]}], "source": "cve-coordination@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB84E2DC-74EA-4956-9521-C2B652B8E8C2", "versionEndExcluding": "2025-09-13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n * This negative offset is then incorrectly added to the buffer pointer (s->byte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s->byte_code.buf + pos, len);"}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de entero en el motor de expresiones regulares QuickJS (libregexp) debido a una representaci\u00f3n inconsistente del tama\u00f1o del b\u00fafer de bytecode.\n\n * El bytecode de la expresi\u00f3n regular se almacena en una estructura DynBuf, que utiliza correctamente un $\\text{size}\\_\\text{t}$ (un tipo sin signo, t\u00edpicamente de 64 bits) para su miembro de tama\u00f1o.\n\n\n * Sin embargo, varias funciones, como re_emit_op_u32 y otras rutinas de an\u00e1lisis internas, convierten o almacenan incorrectamente este valor $\\text{size}\\_\\text{t}$ de DynBuf en un int con signo (t\u00edpicamente de 32 bits).\n\n\n * Cuando una expresi\u00f3n regular grande o compleja (como las generadas por un patr\u00f3n recursivo en una Prueba de Concepto) hace que el tama\u00f1o del bytecode exceda los $2^{31}$ bytes (el valor positivo m\u00e1ximo para un entero con signo de 32 bits), el valor del tama\u00f1o se ajusta, resultando en un entero negativo cuando se almacena en la variable int (Desbordamiento de Entero).\n\n\n * Este valor negativo se utiliza posteriormente en c\u00e1lculos de desplazamiento. Por ejemplo, dentro de funciones como re_parse_disjunction, el tama\u00f1o negativo se utiliza para calcular un desplazamiento (pos) para parchear una instrucci\u00f3n de salto.\n\n\n * Este desplazamiento negativo se a\u00f1ade incorrectamente al puntero del b\u00fafer (s -> byte\\_code.buf + pos), lo que lleva a una escritura fuera de l\u00edmites en la primera l\u00ednea del fragmento siguiente:\n\nput_u32(s -> byte_code.buf + pos, len);"}], "id": "CVE-2025-62495", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62495", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-16T17:40:14.439633Z", "version": "2.0.3"}}]}, "published": "2025-10-16T16:15:40.110", "references": [{"source": "cve-coordination@google.com", "tags": ["Release Notes"], "url": "https://bellard.org/quickjs/Changelog"}, {"source": "cve-coordination@google.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://issuetracker.google.com/434196926"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{}

{"created": "2025-10-21T09:40:05.101107+00:00", "updated": "2025-10-21T09:40:05.101133+00:00", "vendors": ["quickjs-ng", "quickjs-ng$PRODUCT$quickjs"]}