CVE-2025-62492
📋 TL;DR
A floating-point precision error in QuickJS's TypedArray.prototype.indexOf() allows out-of-bounds memory read when using extremely small negative fromIndex values. This affects any application using the QuickJS JavaScript engine, potentially exposing adjacent memory contents. The vulnerability enables limited information disclosure but not code execution.
💻 Affected Systems
- QuickJS JavaScript Engine
📦 What is this software?
Quickjs by Quickjs Project
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive data from adjacent memory buffers, potentially exposing cryptographic keys, authentication tokens, or other application secrets.
Likely Case
Limited memory leak revealing non-sensitive data from adjacent buffers, possibly causing application instability or crashes.
If Mitigated
No impact if proper memory isolation and sandboxing prevent access to sensitive adjacent memory regions.
🎯 Exploit Status
Exploitation requires precise control over JavaScript input and knowledge of memory layout. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check QuickJS changelog for fixes to TypedArray.prototype.indexOf()
Vendor Advisory: https://bellard.org/quickjs/Changelog
Restart Required: No
Instructions:
1. Check QuickJS changelog for latest version. 2. Update QuickJS to patched version. 3. Recompile/redeploy applications using QuickJS.
🔧 Temporary Workarounds
Input validation for fromIndex
allValidate and sanitize fromIndex arguments before passing to TypedArray.prototype.indexOf()
Avoid negative fromIndex values
allRewrite code to avoid using negative fromIndex arguments with TypedArray.prototype.indexOf()
🧯 If You Can't Patch
- Implement strict input validation for all JavaScript execution
- Isolate QuickJS execution in sandboxed environments with memory protection
🔍 How to Verify
Check if Vulnerable:
Test with JavaScript code: new Uint8Array(10).indexOf(0, -1e-20) and check for out-of-bounds behaviorCheck Version:
quickjs --version or check build configurationVerify Fix Applied:
After update, test the same JavaScript code and verify no out-of-bounds access occurs📡 Detection & Monitoring
Log Indicators:
- Memory access violations
- Segmentation faults in QuickJS processes
- Unexpected application crashes
Network Indicators:
- Unusual JavaScript payloads with extremely small negative numbers
SIEM Query:
Process:quickjs AND (EventID:1000 OR ExceptionCode:c0000005)