VDB
CVE-2025-46687
CVE-2025-46687
PUBLISHED
CVSS 5.599999904632568 MEDIUM
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
EPSS 0.30% · 22.9th percentile
Risk Scores
CVSS 3.1
5.599999904632568
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS Score
0.30%
22.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| QuickJS Project | QuickJS | 0 |
| quickjs_project | quickjs | 0 |
| quickjs-ng | quickjs | 0 |
| bellard | quickjs | 0 |
Timeline
- Apr 27, 2025 CVE Published
- Apr 27, 2025 PoC Published
- Apr 28, 2025 EPSS Score
- Apr 28, 2025 CVE Updated
- May 1, 2025 Coalition ESS Score
- May 11, 2025 EPSS Score
- May 24, 2025 EPSS Score
- Jun 5, 2025 EPSS Score
- Jun 9, 2025 Coalition ESS Score
- Jun 18, 2025 EPSS Score
- Jul 1, 2025 EPSS Score
- Jul 14, 2025 EPSS Score
References
- https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a fix
- https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465 fix
- https://github.com/bellard/quickjs/issues/399 discussion
- https://github.com/quickjs-ng/quickjs/issues/1018 discussion
- https://github.com/quickjs-ng/quickjs/pull/1020 fix
- https://bellard.org/quickjs/Changelog url
- https://nvd.nist.gov/vuln/detail/CVE-2025-46687 advisory