CVE-2026-3979: quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function jsiteratorconcatreturn of the file quickjs.c. This manipulation causes use after free. The attack requires local access. The exploit has been published and may be used. Patch name: daab4ad4bae4ef071ed0294618d6244e92def4cd. Applying a patch is the recommended action to fix this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3979?
CVE-2026-3979 has been classified with a moderate severity level due to its local access requirement and potential for exploitation.
How do I fix CVE-2026-3979?
To fix CVE-2026-3979, update quickjs-ng to version 0.12.2 or later.
What is the nature of CVE-2026-3979?
CVE-2026-3979 is a use-after-free vulnerability in the js_iterator_concat_return function of quickjs-ng.
Who is affected by CVE-2026-3979?
CVE-2026-3979 affects users of quickjs-ng versions up to and including 0.12.1.
What could an attacker do with CVE-2026-3979?
An attacker with local access could potentially exploit CVE-2026-3979 to execute arbitrary code.