PT-2026-3427 · Quickjs · Quickjs

Mcsky23 · CVE-2026-1144 · Published 2026-01-01 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions quickjs-ng quickjs versions up to 0.11.0

Description A use-after-free issue exists in quickjs-ng quickjs up to version 0.11.0. The problem is located in an unknown function within the quickjs.c file, specifically in the Atomics Ops Handler component. The issue can be triggered remotely, and an exploit is publicly available.

Recommendations Apply the patch ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 to resolve this issue.

Exploit

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

CVE-2026-1144

OPENSUSE-SU-2026:11037-1

Affected Products

Quickjs

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1144.json · Exploit
• 🔥 https://github.com/quickjs-ng/quickjs/issues/1302 · Exploit
• 🔥 https://github.com/quickjs-ng/quickjs/issues/1301 · Exploit
• https://github.com/quickjs-ng/quickjs/pull/1303 · Patch
• https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1144 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1144 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-1144 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-1144 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1144 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1144 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-1145 · Note
• https://vuldb.com/?submit.735537 · Note