CVE-2026-120439: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

QuickJS-NG before 0.16.0 contains an integer overflow in jstypedarraysort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.