CVE-2025-46687: Buffer Overflow
Published Apr 27, 2025
·Updated
quickjs-ng through 0.9.0 has a missing length check in JSReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
Affected Software
4 affected components
Fabrice Bellard QuickJS<0.9.0
Fabrice Bellard QuickJS<2025-04-26
Bellard Quickjs<2025-04-26
quickjs-ng quickjs<=0.9.0
Remediation
Patch Available
Event History
Apr 27, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-46687?
CVE-2025-46687 has a high severity due to the heap-based buffer overflow vulnerability.
2
How do I fix CVE-2025-46687?
To fix CVE-2025-46687, upgrade QuickJS to version 0.9.0 or later, as well as any versions released after April 26, 2025.
3
Which versions of QuickJS are affected by CVE-2025-46687?
QuickJS versions up to 0.9.0 and those before April 26, 2025, are affected by CVE-2025-46687.
4
What type of vulnerability is CVE-2025-46687?
CVE-2025-46687 is a heap-based buffer overflow vulnerability caused by a missing length check in JS_ReadString.
5
Who is the vendor associated with CVE-2025-46687?
The vendor associated with CVE-2025-46687 is Fabrice Bellard, the creator of QuickJS.