Log in Start free

Vulnerability · Published Nov 5, 2025 · Assigned by VulDB

CVE-2025-12745QuickJS quickjs.c js_array_buffer_slice buffer over-read

Medium 5.3

In plain English

A medium-severity memory corruption in QuickJS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 87.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery Patch name: c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13quickjsno fix listedDEBIAN-CVE-2025-12745
Debian:14quickjsno fix listedDEBIAN-CVE-2025-12745
Ubuntu:25.10quickjsno fix listedUBUNTU-CVE-2025-12745
Ubuntu:26.04:LTSquickjsno fix listedUBUNTU-CVE-2025-12745
Ubuntu:26.10quickjsno fix listedUBUNTU-CVE-2025-12745

Affected products (as reported)

VendorProductVersions
n/a QuickJS eb2c89087def1829ed99630cb14b549d7a98408c

Weakness: CWE-126, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References