Log in Start free

Vulnerability · Published Jan 10, 2026 · Assigned by VulDB

CVE-2026-0822quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow

Medium 6.3

In plain English

A medium-severity heap buffer overflow in quickjs from quickjs-ng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23quickjs-ng0.11.0-r1ALPINE-CVE-2026-0822
Alpine:v3.24quickjs-ng0.11.0-r2ALPINE-CVE-2026-0822
Debian:13quickjsno fix listedDEBIAN-CVE-2026-0822
Debian:14quickjsno fix listedDEBIAN-CVE-2026-0822
Ubuntu:25.10quickjsno fix listedUBUNTU-CVE-2026-0822
Ubuntu:26.04:LTSquickjsno fix listedUBUNTU-CVE-2026-0822

Affected products (as reported)

VendorProductVersions
quickjs-ng quickjs 0.10.20.30.40.50.60.70.8

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References