PT-2026-3427 · Quickjs · Quickjs

Mcsky23 · Published 2026-01-01 · Updated 2026-01-30 · CVE-2026-1144

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions quickjs-ng quickjs versions up to 0.11.0

Description A use-after-free issue exists in quickjs-ng quickjs up to version 0.11.0. The problem is located in an unknown function within the quickjs.c file, specifically in the Atomics Ops Handler component. The issue can be triggered remotely, and an exploit is publicly available.

Recommendations Apply the patch ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 to resolve this issue.

Exploit

Fix

Buffer Overflow

Use After Free

Weakness Enumeration

CWE-119

CWE-416

Related Identifiers

CVE-2026-1144

Affected Products

Quickjs

References · 19

• 🔥 https://github.com/quickjs-ng/quickjs/issues/1301 · Exploit
• 🔥 https://github.com/quickjs-ng/quickjs/issues/1302 · Exploit
• https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 · Patch
• https://github.com/quickjs-ng/quickjs/pull/1303 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-1144 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1144 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1144 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1144 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1144 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-1144 · Security Note
• https://vuldb.com/?ctiid.341737 · Note
• https://t.me/cveNotify/150412 · Telegram Post
• https://vuldb.com/?id.341737 · Note
• https://vuldb.com/?submit.735538 · Note