PT-2026-3428 · Quickjs+1 · Quickjs+1

Mcsky23 · Published 2026-01-19 · Updated 2026-01-19 · CVE-2026-1145

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions quickjs-ng versions up to 0.11.0

Description A flaw exists in quickjs-ng quickjs due to a heap-based buffer overflow in the js typed array constructor ta function within the quickjs.c file. This manipulation allows for remote exploitation. An exploit for this issue has been published.

Recommendations Install patch 53aebe66170d545bb6265906fe4324e4477de8b4 to address this issue.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2026-1145

Affected Products

Quickjs

Quickjs-Ng

References · 14

• 🔥 https://github.com/quickjs-ng/quickjs/issues/1305 · Exploit
• 🔥 https://github.com/quickjs-ng/quickjs/issues/1305#issue-3785444372 · Exploit
• https://github.com/quickjs-ng/quickjs/pull/1306 · Patch
• https://github.com/paralin/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-1145 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1145 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1145 · Vendor Advisory
• https://vuldb.com/?id.341738 · Note
• https://twitter.com/CVEnew/status/2013166349670125633 · Twitter Post
• https://vuldb.com/?submit.735539 · Note
• https://github.com/quickjs-ng/quickjs · Note
• https://vuldb.com/?ctiid.341738 · Note
• https://twitter.com/VulmonFeeds/status/2013188576511479819 · Twitter Post