CVE-2025-46688
📋 TL;DR
This vulnerability is a heap-based buffer overflow in QuickJS and quickjs-ng JavaScript engines due to incorrect size calculation in JS_ReadBigInt for BigInt values. It affects applications using vulnerable versions of these engines, potentially allowing memory corruption. Both QuickJS before 2025-04-26 and quickjs-ng through 0.9.0 are vulnerable.
💻 Affected Systems
- QuickJS
- quickjs-ng
📦 What is this software?
Quickjs by Quickjs Ng
Quickjs by Quickjs Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption
Likely Case
Application crash or denial of service due to memory corruption
If Mitigated
Limited impact with proper memory protections and exploit mitigations
🎯 Exploit Status
Exploitation requires triggering the vulnerable BigInt parsing code path with crafted input
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QuickJS 2025-04-26 or later, quickjs-ng 0.9.1 or later
Vendor Advisory: https://bellard.org/quickjs/Changelog
Restart Required: Yes
Instructions:
1. Update QuickJS to 2025-04-26 or later from https://bellard.org/quickjs/ 2. Update quickjs-ng to 0.9.1 or later from https://github.com/quickjs-ng/quickjs 3. Rebuild and redeploy any applications using these engines
🔧 Temporary Workarounds
Input validation for BigInt
allValidate or sanitize BigInt inputs before processing
Memory protection hardening
linuxEnable ASLR, DEP, and other memory protection mechanisms
echo 2 > /proc/sys/kernel/randomize_va_space
sysctl -w kernel.exec-shield=1
🧯 If You Can't Patch
- Implement strict input validation for BigInt data
- Isolate QuickJS processes with containerization or sandboxing
🔍 How to Verify
Check if Vulnerable:
Check QuickJS version date or quickjs-ng version number in your applicationCheck Version:
qjs --version or check embedded library version in your applicationVerify Fix Applied:
Verify updated version is being used and test with known safe BigInt inputs📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected termination of QuickJS processes
Network Indicators:
- Unusual patterns of BigInt data being sent to applications
SIEM Query:
process_name:"qjs" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://bellard.org/quickjs/Changelog
- https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a
- https://github.com/bellard/quickjs/issues/399
- https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465
- https://github.com/quickjs-ng/quickjs/issues/1018
- https://github.com/quickjs-ng/quickjs/pull/1020
- https://github.com/quickjs-ng/quickjs/issues/1018
