CVE-2026-120440: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

Published Nov 2, 2026

Updated

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in jsatomicsstore() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

Affected Software

1 affected component

ubuntu/quickjs-ng*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments of QuickJS-NG before 0.16.0 are exposed when they execute attacker-controlled JavaScript. The impact is heap-memory exhaustion and denial of service.

What does an attacker need to do to trigger the leak?

An attacker needs to repeatedly invoke Atomics.store with a valueOf implementation that detaches or shrinks the buffer. No privileges or user interaction are indicated by the supplied severity vector.

What versions contain the fix?

The issue affects QuickJS-NG versions before 0.16.0. The referenced fix is associated with the 0.16.0 release.

CVE-2026-120440: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the leak?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the leak?

What versions contain the fix?