CVE-2026-120438

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120438", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:15.054Z", "datePublished": "2026-11-02T14:29:00.633Z", "dateUpdated": "2026-11-05T21:38:15.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:00.633Z"}, "datePublic": "2026-07-31T00:00:00.000Z", "title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration", "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "quickjs-ng", "product": "QuickJS-NG", "packageURL": "pkg:github/quickjs-ng/quickjs", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "0.16.0", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/quickjs-ng/quickjs"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.16.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-jp52-chwg-2p9p)"}, {"url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068", "tags": ["patch"]}, {"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0", "tags": ["release-notes"], "name": "QuickJS-NG v0.16.0 Release Notes"}, {"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"}], "credits": [{"lang": "en", "value": "Tristan Madani (Talence Security)", "type": "finder"}, {"lang": "en", "value": "Sa\u00fal Ibarra Corretg\u00e9", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:37:52.469353Z", "id": "CVE-2026-120438", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:38:15.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:37:52.469353Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:38:04.111Z"}}], "cna": {"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani (Talence Security)"}, {"lang": "en", "type": "remediation developer", "value": "Sa\u00fal Ibarra Corretg\u00e9"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/quickjs-ng/quickjs", "vendor": "quickjs-ng", "product": "QuickJS-NG", "versions": [{"status": "affected", "version": "0", "lessThan": "0.16.0", "versionType": "semver"}], "packageURL": "pkg:github/quickjs-ng/quickjs", "defaultStatus": "unaffected"}], "datePublic": "2026-07-31T00:00:00.000Z", "references": [{"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p", "name": "GitHub Security Advisory (GHSA-jp52-chwg-2p9p)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068", "tags": ["patch"]}, {"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0", "name": "QuickJS-NG v0.16.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration", "name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.16.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:00.633Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120438", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:38:15.836Z", "dateReserved": "2026-11-02T12:42:15.054Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:00.633Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/quickjs-ng/quickjs", "product": "QuickJS-NG", "repo": "https://github.com/quickjs-ng/quickjs", "vendor": "quickjs-ng", "versions": [{"lessThan": "0.16.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."}], "id": "CVE-2026-120438", "lastModified": "2026-11-05T22:17:54.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120438", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:37:52.469353Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:25.767", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "quickjs-ng: quickjs-ng: Arbitrary code execution via integer overflow during proxy property enumeration", "id": "2567545", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567545"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.", "A flaw was found in QuickJS-NG. This vulnerability allows an attacker executing JavaScript code to potentially achieve arbitrary code execution or cause a denial of service (DoS) through an application crash. The issue occurs due to an integer overflow during proxy property enumeration on 32-bit systems, which triggers a heap-based buffer overflow when an oversized array-like object is processed."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-120438", "public_date": "2026-11-02T14:29:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120438\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120438\nhttps://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509\nhttps://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068\nhttps://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0\nhttps://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p\nhttps://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"], "statement": "Red Hat rates the impact of this vulnerability as Important because an unprivileged local attacker executing untrusted JavaScript can corrupt heap memory and potentially achieve arbitrary code execution within the context of the host application. Although code execution is theoretically possible, exploitation is constrained by the requirement that the host application evaluate untrusted input and is predominantly viable on 32-bit platforms where integer wrapping occurs during proxy property handling. Standard 64-bit enterprise deployments naturally resist this integer overflow mechanism, substantially reducing practical risk across supported platforms.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "QuickJS-NG", "source": "cna", "vendor": "quickjs-ng"}, "product": "quickjs", "vendor": "quickjs-ng"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.0)"}}], "original": {"product": "QuickJS-NG", "source": "cna", "vendor": "quickjs-ng"}, "product": "quickjs", "vendor": "quickjs_project"}], "created": "2026-11-02T15:30:14.816803+00:00", "updated": "2026-11-06T15:30:06.478553+00:00", "vendors": ["quickjs-ng", "quickjs-ng$PRODUCT$quickjs", "quickjs_project", "quickjs_project$PRODUCT$quickjs"], "weaknesses": ["CWE-190", "CWE-787"]}