UBUNTU-CVE-2026-120438: Buffer Overflow
QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Only 32-bit hosts running QuickJS-NG versions before 0.16.0 are described as affected. The issue is triggered while processing JavaScript Proxy ownKeys results.
What access does an attacker need to exploit it?
An attacker needs the ability to run JavaScript in the affected QuickJS-NG environment. They can use a Proxy ownKeys trap that returns a large array-like object to trigger allocation-size wrapping.
Are 64-bit hosts affected?
The provided information identifies the heap buffer overflow as occurring on 32-bit hosts. It does not state that 64-bit hosts are affected.
What is the impact if exploitation succeeds?
The overflow can cause crashes and may allow code execution. The reported impact includes high confidentiality, integrity, and availability effects.