CVE-2026-0821
Heap-Based Buffer Overflow in QuickJS-ng js_typed_array_constructor
Publication date: 2026-01-10
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| quickjs-ng | quickjs | to 0.11.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0821 is a heap-based buffer overflow vulnerability in the QuickJS JavaScript engine (quickjs-ng versions up to 0.11.0). It occurs in the function `js_typed_array_constructor` when constructing typed arrays. An attacker can define a malicious getter on the prototype of the constructor that resizes or detaches the underlying ArrayBuffer during construction. This causes the constructor to operate on stale or invalid buffer data, leading to out-of-bounds memory access and a heap buffer overflow. The vulnerability can be exploited remotely without authentication, potentially allowing attackers to execute arbitrary code or cause crashes. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can compromise the confidentiality, integrity, and availability of systems using the affected QuickJS engine. Exploiting the heap buffer overflow can allow attackers to execute arbitrary code remotely, crash applications, or corrupt memory, leading to denial of service or unauthorized access. Since the exploit is publicly available and requires no authentication, systems are at high risk if unpatched. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2026-0821 involves monitoring for exploitation attempts targeting the js_typed_array_constructor function in quickjs-ng QuickJS versions up to 0.11.0. Since the vulnerability is triggered by JavaScript code that manipulates typed arrays with side effects (such as resizing or detaching ArrayBuffers), detection can include: 1) Using AddressSanitizer (ASAN) or similar memory error detection tools when running QuickJS to catch heap buffer overflow errors. 2) Monitoring logs or crash reports for heap-buffer-overflow errors related to typed array operations. 3) Reviewing GitHub issue #1296 for reproduction steps and PoC code that can be used to test your environment. 4) Running the provided test case (e.g., tests/bug1296.js) that triggers the vulnerability to verify if your QuickJS version is vulnerable. Specific commands are not explicitly provided in the resources, but using ASAN with QuickJS and running the PoC or test scripts from the GitHub repository can help detect the vulnerability. [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the official patch for CVE-2026-0821, identified by commit c5d80831e51e48a83eab16ea867be87f091783c5 on the quickjs-ng GitHub repository. This patch adds re-validation of the ArrayBuffer state after side effects during typed array construction, preventing out-of-bounds access and heap buffer overflow. Users should update their quickjs-ng QuickJS engine to a version including this fix or manually apply the patch. Additionally, avoid running untrusted JavaScript code that constructs typed arrays with potentially malicious prototype getters until the patch is applied. Monitoring for public proof-of-concept exploits and restricting remote access to vulnerable QuickJS instances can also reduce risk. [1, 4, 5]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can compromise the confidentiality, integrity, and availability of affected systems by allowing remote attackers to execute heap-based buffer overflow attacks. Such compromises can lead to unauthorized access or data breaches, which may result in non-compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and system integrity. Therefore, failure to patch this vulnerability could negatively impact compliance with these regulations. [1]