{"id":"CVE-2026-120439","title":"QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort","summary":"QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"quickjs-ng","product":"QuickJS-NG","affected":["QuickJS-NG < 0.16.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T19:30:12.358583Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:30:29.306Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120439","references":[{"url":"https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6","label":"GitHub Security Advisory (GHSA-9wv5-5cgr-grj6)"},{"url":"https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568"},{"url":"https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","label":"QuickJS-NG v0.16.0 Release Notes"},{"url":"https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032"},{"url":"https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort","label":"VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort"}],"tags":["cve.org","exploit-available"],"epss":0.00343,"epssPercentile":0.28017,"ingestedAt":"2026-11-05T19:30:42.654Z","slug":"CVE-2026-120439","body":"## Overview\n\nQuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.\n\n## Affected\n\n- `QuickJS-NG < 0.16.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":235611,"id":"CVE-2026-120439","ts":1793995422959,"field":"exploit_available","old":"false","new":"true"}]}