CVE-2025-62495
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-29

Assigner: Google Inc.

Description
An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typically 32-bit). * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow). * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative offset is then incorrectly added to the buffer pointer (s->byte\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s->byte_code.buf + pos, len);
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-16
Last Modified
2025-10-29
Generated
2026-05-06
AI Q&A
2025-10-16
EPSS Evaluated
2026-05-05
NVD
CVE-2025-62495
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
quickjs_project quickjs to 2025-09-13 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an integer overflow in the QuickJS regular expression engine's bytecode buffer size handling. The bytecode size is stored as an unsigned 64-bit value but is incorrectly cast to a signed 32-bit integer in some functions. When the bytecode size exceeds the maximum positive value for a signed 32-bit integer, it wraps around to a negative number. This negative value is then used in offset calculations, causing out-of-bounds writes in memory, which can lead to memory corruption.


How can this vulnerability impact me? :

This vulnerability can lead to out-of-bounds memory writes, potentially causing memory corruption. This can be exploited to crash the application, execute arbitrary code, or escalate privileges, depending on the context in which the QuickJS engine is used.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart