Heap Out-of-Bounds Write in QuickJS

Executive Summary

CVE-2026-88378 is a heap-buffer-overflow vulnerability in QuickJS's JS_ReadFunctionTag function. It occurs when signed count fields (closure_var_count and cpool_count) are read as unsigned LEB128 values, causing negative values to wrap around during allocation-size calculations. This leads to insufficient memory allocation and subsequent heap-based buffer overflow when processing attacker-controlled bytecode.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running QuickJS for crashes or memory corruption when processing malformed bytecode. Monitor for heap-buffer-overflow errors in logs or use tools like AddressSanitizer (ASan) to detect out-of-bounds writes during execution of JS_ReadFunctionTag.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on systems using vulnerable QuickJS versions. It is triggered by malformed bytecode input, potentially leading to crashes or remote code execution if QuickJS is used in applications processing untrusted data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution through heap-based buffer overflows. Exploitation may lead to unauthorized data access, modification, or disclosure, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update QuickJS to the latest patched version that includes the fix for JS_ReadFunctionTag. If updating is not possible, apply the patch from pull request #553 which validates integer counts and prevents overflow. Avoid processing untrusted bytecode until patched.

Useful 0 Not Useful 0