CVE-2025-62493
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) stems from an incorrect calculation of the required number of digits, leading to reading memory past the allocated BigInt structure. In certain edge cases, the conversion loop reads data spanning two limbs, causing an out-of-bounds read.
Risk Assessment
This can lead to information disclosure of sensitive data stored on the heap adjacent to the BigInt object, posing a data leak risk for organizations using QuickJS.
Recommendation
Update QuickJS to a version containing the fix for CVE-2025-62493, or apply a workaround by avoiding BigInt-to-string conversion in untrusted contexts until the patch is deployed.
Other vulnerabilities in QuickJS
See all- CVE-2026-88378Critical
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
- CVE-2025-12745Medium
In QuickJS up to commit eb2c89087def1829ed99630cb14b549d7a98408c, the function js_array_buffer_slice in quickjs.c causes a buffer over-read. The attack requires local execution, and the exploit is publicly available.
- CVE-2025-62496High
A vulnerability in the QuickJS engine when creating a BigInt from a string with an excessively large number of digits. The bit count calculation causes an integer overflow, leading to an underestimated buffer size and a heap out-of-bounds write.
- CVE-2025-62495High
An integer overflow vulnerability in the QuickJS regular expression engine (libregexp) due to inconsistent representation of the bytecode buffer size. A large or complex regular expression can cause the size to wrap around and lead to an out-of-bounds write.
- CVE-2025-62494High
A type confusion vulnerability exists in the QuickJS engine's handling of the string addition (+) operation. During conversion of the right-hand operand, a callback can change the type of the left-hand operand, leading to a type mismatch and potential out-of-bounds memory access.
- CVE-2025-62492Medium
A floating-point arithmetic precision error exists in QuickJS's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. When the value is extremely small (e.g., -1e-20), adding the array length can lose precision and yield an index equal to the length, causing an out-of-bounds read of one element. This may lead to information disclosure of adjacent memory.
- CVE-2025-62491High
A use-after-free exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (rejected_promise_list). A malicious property getter on an Error object can call catch() on the same rejected promise, which removes and frees the current list entry while the loop continues using the freed pointer.
- CVE-2025-62490High
In QuickJS's js_print_object, printing an array fetches the length and then loops over it, but printing a value is not side-effect free. An attacker-defined callback can run during js_print_value and resize the array, causing a use-after-free; a second instance occurs when printing Map or Set objects whose records list can be modified during js_print_value.
Original NVD description (English source)
A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. * The function determines the number of characters (n_digits) needed for the string representation by calculating: $$ \\ \text{n\_digits} = (\text{n\_bits} + \text{log2\_radix} - 1) / \text{log2\_radix}$$ $$$$This formula is off-by-one in certain edge cases when calculating the necessary memory limbs. For instance, a 127-bit BigInt using radix 32 (where $\text{log2\_radix}=5$) is calculated to need $\text{n\_digits}=26$. * The maximum number of bits actually stored is $\text{n\_bits}=127$, which requires only two 64-bit limbs ($\text{JS\_LIMB\_BITS}=64$). * The conversion loop iterates $\text{n\_digits}=26$ times, attempting to read 5 bits in each iteration, totaling $26 \times 5 = 130$ bits. * In the final iterations of the loop, the code attempts to read data that spans two limbs: C c = (r->tab[pos] >> shift) | (r->tab[pos + 1] << (JS_LIMB_BITS - shift)); * Since the BigInt was only allocated two limbs, the read operation for r->tab[pos + 1] becomes an Out-of-Bounds Read when pos points to the last valid limb (e.g., $pos=1$). This vulnerability allows an attacker to cause the engine to read and process data from the memory immediately following the BigInt buffer. This can lead to Information Disclosure of sensitive data stored on the heap adjacent to the BigInt object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS