Heap-Based Buffer Overflow in QuickJS-ng js_typed_array_constructor_ta

Executive Summary

CVE-2026-1145 is a heap-based buffer overflow vulnerability in the QuickJS JavaScript engine (quickjs-ng up to version 0.11.0), specifically in the function js_typed_array_constructor_ta. The issue occurs when constructing a typed array from another typed array using Reflect.construct with a malicious new_target. During this process, JavaScript code executed via prototype property lookup on new_target resizes the underlying Resizable ArrayBuffer, invalidating a previously stored length value. Because the length is stale, a memcpy operation copies data beyond the valid buffer boundaries, causing a heap out-of-bounds access or use-after-free condition. This flaw allows remote attackers to execute arbitrary JavaScript code and potentially exploit memory corruption. [1, 3, 5]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing remote attackers to cause a heap buffer overflow or use-after-free condition in the QuickJS engine, potentially leading to arbitrary code execution. This compromises the confidentiality, integrity, and availability of the affected system. Since the exploit is publicly available and can be triggered remotely without authentication (though user interaction is required), it poses a significant security risk. Attackers could leverage this flaw to execute malicious JavaScript code, crash applications, or escalate privileges. [1, 3, 5]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by reproducing the heap buffer overflow condition using the proof-of-concept (PoC) described in Resource 5, which involves creating a specially crafted JavaScript that constructs a typed array with a malicious constructor that resizes the underlying ArrayBuffer during construction. Running this PoC with AddressSanitizer (ASAN) enabled will show heap buffer overflow errors. There are no specific network detection commands provided, but monitoring for crashes or ASAN reports when running QuickJS with untrusted JavaScript input can help detect exploitation attempts. [5]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the official patch identified by commit 53aebe66170d545bb6265906fe4324e4477de8b4, which adds critical bounds checking in the function js_typed_array_constructor_ta to prevent out-of-bounds memory access. Updating quickjs-ng/quickjs to a version including this fix (merged on January 6, 2026) will resolve the vulnerability. Until patched, avoid running untrusted JavaScript code that constructs typed arrays from other typed arrays, especially if it involves proxies or constructors that can resize buffers. [2, 4]

Useful 0 Not Useful 0