← Vulnerability feed

Vulnerability record · CVE-2024-33263 · published 14 May 2024

CVE-2024-33263: Bellard quickjs vulnerability

Bellard · Quickjs

QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c.

4.0 CVSS 3.1 Medium EPSS 0.32% · top 78.0% CWE-617 · CWE-617
4.0CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/bellard/quickjs/issues/277 ExploitIssue Tracking
https://github.com/bellard/quickjs/issues/277 ExploitIssue Tracking

Track CVE-2024-33263 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2025-46687Bellard quickjs allocation without limits vulnerabilityquickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26…EPSS 0.30%1.9CVE-2025-12745Bellard quickjs memory buffer overflow vulnerabilityA weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file…EPSS 0.20%

Source: NIST National Vulnerability Database (record CVE-2024-33263), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.