CVE-2026-120440Medium· 5.3▾ SunlitQuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a va…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
QuickJS-NG < 0.16.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120438High· 7.8QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
CVE-2026-120439High· 7.0QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
CVE-2025-39890Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is not freed in the failure ca…
CVE-2022-38178High· 7.5By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak
CVE-2022-38177High· 7.5By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak
CVE-2022-50420Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/hpre - fix resource leak in remove process In hpre_remove(), when the disable operation of qm sriov failed, the following logic should continue to be…