CVE-2025-70347
Denial of Service in mquickjs get_mblock_size Function
Publication date: 2026-02-10
Last updated on: 2026-02-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bellard | mquickjs | to 74b7e (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The CVE-2025-70347 vulnerability is a flaw in the mquickjs program, specifically in the function get_mblock_size within the source file mquickjs.c. It causes a segmentation fault (SEGV) due to a read memory access violation during execution. This fault occurs when processing a crafted file, leading to a crash triggered by AddressSanitizer. The issue is linked to an error raised when the array length is modified in Array.prototype.splice, which is difficult to handle practically.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) by crashing the mquickjs program when it processes a specially crafted file. The segmentation fault leads to an abort of the program, potentially disrupting services or applications that rely on mquickjs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the crash in the mqjs executable using a crafted proof-of-concept file that triggers the segmentation fault in the get_mblock_size function.
Detection steps include cloning the bellard/mquickjs repository, building the project with the command `make -j12`, and then running the mqjs executable with debugging enabled on the provided proof-of-concept file named `poc-get_mblock_size-SEGV`.
Specifically, running the mqjs program with the crafted file will cause a segmentation fault detected by AddressSanitizer, indicating the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
I don't know