PT-2025-42493 · Quickjs+1 · Quickjs+1

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-62496

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QuickJS (affected versions not specified)

Description A flaw exists in the QuickJS engine’s BigInt string parsing logic within the js bigint from string function when creating a BigInt from a string containing a very large number of digits. The function calculates the required number of bits using a formula that can cause an Integer Overflow for large input strings. This results in an underestimated memory allocation for the BigInt object, leading to a Heap Out-of-Bounds Write when the data is written to the r->tab array. The formula used for calculation is: n bits = (n digits * 27 + 7) / 8 (for radix 10).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2025-62496

Affected Products

Debian

Quickjs

References · 11

• 🔥 https://issuetracker.google.com/434193016 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62496 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62496 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-62496 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62496 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-62496 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-62496 · Security Note
• https://t.me/CVEtracker/35109 · Telegram Post
• https://bellard.org/quickjs/Changelog · Note
• https://twitter.com/CVEnew/status/1978926586456904040 · Twitter Post