CVE-2026-120440

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120440", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:15.887Z", "datePublished": "2026-11-02T14:29:02.038Z", "dateUpdated": "2026-11-02T17:33:29.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:02.038Z"}, "datePublic": "2026-07-31T00:00:00.000Z", "title": "QuickJS-NG before 0.16.0 Memory Leak via Atomics.store", "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Release of Memory after Effective Lifetime", "cweId": "CWE-401", "type": "CWE"}]}], "affected": [{"vendor": "quickjs-ng", "product": "QuickJS-NG", "packageURL": "pkg:github/quickjs-ng/quickjs", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "0.16.0", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/quickjs-ng/quickjs"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.16.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wm7w-r6qf-3c9w)"}, {"url": "https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e", "tags": ["patch"]}, {"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0", "tags": ["release-notes"], "name": "QuickJS-NG v0.16.0 Release Notes"}, {"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store"}], "credits": [{"lang": "en", "value": "Tristan Madani (Talence Security)", "type": "finder"}, {"lang": "en", "value": "Sa\u00fal Ibarra Corretg\u00e9", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T17:12:52.060134Z", "id": "CVE-2026-120440", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:33:29.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120440", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T17:12:52.060134Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:12:52.775Z"}}], "cna": {"title": "QuickJS-NG before 0.16.0 Memory Leak via Atomics.store", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani (Talence Security)"}, {"lang": "en", "type": "remediation developer", "value": "Sa\u00fal Ibarra Corretg\u00e9"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/quickjs-ng/quickjs", "vendor": "quickjs-ng", "product": "QuickJS-NG", "versions": [{"status": "affected", "version": "0", "lessThan": "0.16.0", "versionType": "semver"}], "packageURL": "pkg:github/quickjs-ng/quickjs", "defaultStatus": "unaffected"}], "datePublic": "2026-07-31T00:00:00.000Z", "references": [{"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w", "name": "GitHub Security Advisory (GHSA-wm7w-r6qf-3c9w)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e", "tags": ["patch"]}, {"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0", "name": "QuickJS-NG v0.16.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store", "name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "Missing Release of Memory after Effective Lifetime"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.16.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:02.038Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120440", "state": "PUBLISHED", "dateUpdated": "2026-11-02T17:33:29.004Z", "dateReserved": "2026-11-02T12:42:15.887Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:02.038Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/quickjs-ng/quickjs", "product": "QuickJS-NG", "repo": "https://github.com/quickjs-ng/quickjs", "vendor": "quickjs-ng", "versions": [{"lessThan": "0.16.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service."}], "id": "CVE-2026-120440", "lastModified": "2026-11-02T19:34:23.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120440", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T17:12:52.060134Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:26.103", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "quickjs-ng: quickjs-ng: Denial of Service via memory leak in atomic store operations", "id": "2565315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565315"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.", "A flaw was found in QuickJS-NG. This vulnerability allows an attacker capable of running JavaScript code to cause a Denial of Service (DoS) through memory exhaustion. The issue occurs when the JavaScript engine fails to release allocated memory upon encountering an error during atomic storage operations. By repeatedly executing these operations with manipulated memory buffers, an attacker can exhaust system memory, causing the application to crash or become unresponsive."], "name": "CVE-2026-120440", "public_date": "2026-11-02T14:29:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120440\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120440\nhttps://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154\nhttps://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e\nhttps://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0\nhttps://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w\nhttps://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate impact because triggering the memory exhaustion requires an attacker to supply and execute untrusted JavaScript code, limiting the blast radius to a denial of service without integrity or confidentiality loss. QuickJS-NG is not shipped as part of core Red Hat Enterprise Linux distributions and is primarily utilized within community repositories or specialized analysis utilities. Applications embedding this engine remain unaffected unless they process unvetted scripts without memory allocation limits.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "QuickJS-NG", "source": "cna", "vendor": "quickjs-ng"}, "product": "quickjs", "vendor": "quickjs-ng"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.16.0)"}}], "original": {"product": "QuickJS-NG", "source": "cna", "vendor": "quickjs-ng"}, "product": "quickjs", "vendor": "quickjs_project"}], "created": "2026-11-02T15:30:14.816532+00:00", "updated": "2026-11-04T14:00:09.560164+00:00", "vendors": ["quickjs-ng", "quickjs-ng$PRODUCT$quickjs", "quickjs_project", "quickjs_project$PRODUCT$quickjs"]}