← Vulnerability feed

Vulnerability record · CVE-2025-46687 · published 27 April 2025

CVE-2025-46687: Bellard quickjs allocation without limits vulnerability

Bellard · Quickjs

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

7.8 CVSS 3.1 High EPSS 0.30% · top 79.5% CWE-770 · Allocation without limits
7.8CVSS 3.1 base score
0.30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bellard.org/quickjs/Changelog Release Notes
https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a Patch
https://github.com/bellard/quickjs/issues/399 ExploitIssue TrackingVendor Advisory
https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465 Patch
https://github.com/quickjs-ng/quickjs/issues/1018 ExploitIssue TrackingVendor Advisory
https://github.com/quickjs-ng/quickjs/pull/1020 Issue TrackingPatch

Track CVE-2025-46687 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2025-46688Quickjs-ng quickjs vulnerabilityquickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 202…EPSS 0.32%5.5CVE-2026-0821Quickjs-ng quickjs memory buffer overflow vulnerabilityA vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file qui…EPSS 0.50%5.3CVE-2024-13903Quickjs-ng quickjs memory buffer overflow vulnerabilityA vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_G…EPSS 0.70%4.0CVE-2024-33263Bellard quickjs vulnerabilityQuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c.EPSS 0.32%2.1CVE-2026-1145Quickjs-ng quickjs memory buffer overflow vulnerabilityA flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file qu…EPSS 0.40%2.1CVE-2026-1144Quickjs-ng quickjs memory buffer overflow vulnerabilityA vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops H…EPSS 0.41%2.1CVE-2026-0822Quickjs-ng quickjs memory buffer overflow vulnerabilityA vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The man…EPSS 0.46%1.9CVE-2025-12745Bellard quickjs memory buffer overflow vulnerabilityA weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file…EPSS 0.20%

Source: NIST National Vulnerability Database (record CVE-2025-46687), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.