CVE-2026-1144

Katalog CVE

CVSS 8.8 · High EPSS 0,41%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada quickjs-ng quickjs. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141. Applying a patch is advised to resolve this issue.

Rincian

Terbit di NVD

19 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416: Use After Free

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 patch
• https://github.com/quickjs-ng/quickjs/pull/1303 issue tracking · patch
• https://vuldb.com/?id.341737 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.735537 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.735538 advisory pihak ketiga · vdb entry
• https://github.com/quickjs-ng/quickjs/issues/1301 exploit · issue tracking
• https://github.com/quickjs-ng/quickjs/issues/1302 exploit · issue tracking
• https://github.com/quickjs-ng/quickjs/
• https://vuldb.com/?ctiid.341737 permissions required · vdb entry