VDB
CVE-2026-0822
CVE-2026-0822
PUBLISHED
CVSS 5.3 MEDIUM
Reported by VulDB · Published January 10, 2026
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| quickjs-ng | quickjs | 0.1, 0.2, 0.3 |
| quickjs-ng | quickjs | 0.1, 0.2, 0.3 |
Timeline
- Jan 6, 2026 Fix PR Merged
- Jan 10, 2026 CVE Published
- Jan 10, 2026 PoC Published
- Jan 10, 2026 PoC Published
- Jan 11, 2026 EPSS Score
- Jan 15, 2026 EPSS Score
- Jan 19, 2026 EPSS Score
- Jan 23, 2026 EPSS Score
- Jan 27, 2026 EPSS Score
- Jan 31, 2026 EPSS Score
- Feb 4, 2026 EPSS Score
- Feb 8, 2026 EPSS Score
References
- VDB-340356 | quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow vdb-entrytechnical-description
- VDB-340356 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
- Submit #731783 | quickjs-ng quickjs v0.11.0 Heap-based Buffer Overflow third-party-advisory
- issue-tracking
- issue-tracking
- exploitissue-tracking
- patch
- product