CVE-2026-1145
Heap-Based Buffer Overflow in QuickJS-ng js_typed_array_constructor_ta
Publication date: 2026-01-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| quickjs-ng | quickjs | to 0.11.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1145 is a heap-based buffer overflow vulnerability in the QuickJS JavaScript engine (quickjs-ng up to version 0.11.0), specifically in the function js_typed_array_constructor_ta. The issue occurs when constructing a typed array from another typed array using Reflect.construct with a malicious new_target. During this process, JavaScript code executed via prototype property lookup on new_target resizes the underlying Resizable ArrayBuffer, invalidating a previously stored length value. Because the length is stale, a memcpy operation copies data beyond the valid buffer boundaries, causing a heap out-of-bounds access or use-after-free condition. This flaw allows remote attackers to execute arbitrary JavaScript code and potentially exploit memory corruption. [1, 3, 5]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to cause a heap buffer overflow or use-after-free condition in the QuickJS engine, potentially leading to arbitrary code execution. This compromises the confidentiality, integrity, and availability of the affected system. Since the exploit is publicly available and can be triggered remotely without authentication (though user interaction is required), it poses a significant security risk. Attackers could leverage this flaw to execute malicious JavaScript code, crash applications, or escalate privileges. [1, 3, 5]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the heap buffer overflow condition using the proof-of-concept (PoC) described in Resource 5, which involves creating a specially crafted JavaScript that constructs a typed array with a malicious constructor that resizes the underlying ArrayBuffer during construction. Running this PoC with AddressSanitizer (ASAN) enabled will show heap buffer overflow errors. There are no specific network detection commands provided, but monitoring for crashes or ASAN reports when running QuickJS with untrusted JavaScript input can help detect exploitation attempts. [5]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the official patch identified by commit 53aebe66170d545bb6265906fe4324e4477de8b4, which adds critical bounds checking in the function js_typed_array_constructor_ta to prevent out-of-bounds memory access. Updating quickjs-ng/quickjs to a version including this fix (merged on January 6, 2026) will resolve the vulnerability. Until patched, avoid running untrusted JavaScript code that constructs typed arrays from other typed arrays, especially if it involves proxies or constructors that can resize buffers. [2, 4]