CVE-2026-1145: quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow
A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function jstypedarrayconstructorta of the file quickjs.c. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 53aebe66170d545bb6265906fe4324e4477de8b4. It is suggested to install a patch to address this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1145?
CVE-2026-1145 has a high severity due to its potential for a heap-based buffer overflow which can lead to code execution.
How do I fix CVE-2026-1145?
To fix CVE-2026-1145, update quickjs-ng to version 0.11.1 or later.
What causes CVE-2026-1145?
CVE-2026-1145 is caused by improper handling in the js_typed_array_constructor_ta function of quickjs.c.
Who is affected by CVE-2026-1145?
Users of quickjs-ng versions up to 0.11.0 are affected by CVE-2026-1145.
What types of attacks can occur with CVE-2026-1145?
CVE-2026-1145 can facilitate remote code execution and allow attackers to manipulate system memory.