Vulnerability · Published Oct 16, 2025 · Assigned by Google
CVE-2025-62490Use-after-free in js_print_object in QuickJS
High 8.8
In plain English
A high-severity use-after-free in QuickJS from QuickJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during js_print_value call.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | quickjs | no fix listed | DEBIAN-CVE-2025-62490 |
| Debian:14 | quickjs | no fix listed | DEBIAN-CVE-2025-62490 |
| Ubuntu:25.10 | quickjs | no fix listed | UBUNTU-CVE-2025-62490 |
| Ubuntu:26.04:LTS | quickjs | no fix listed | UBUNTU-CVE-2025-62490 |
| Ubuntu:26.10 | quickjs | no fix listed | UBUNTU-CVE-2025-62490 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L