Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120439QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

High 7.0

In plain English

A high-severity integer overflow in QuickJS-NG from quickjs-ng. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	quickjs-ng	0.16.2-1	DEBIAN-CVE-2026-120439
Ubuntu:26.10	quickjs-ng	no fix listed	UBUNTU-CVE-2026-120439

Affected products (as reported)

Vendor	Product	Versions
quickjs-ng	QuickJS-NG	0 – before 0.16.0

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References

GitHub Security Advisory (GHSA-9wv5-5cgr-grj6) vendor-advisory
https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568 patch
QuickJS-NG v0.16.0 Release Notes release-notes
https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032 technical-description
VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort third-party-advisory