UBUNTU-CVE-2026-120439: Buffer Overflow
QuickJS-NG before 0.16.0 contains an integer overflow in jstypedarraysort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Affected Software
Event History
Frequently Asked Questions
Which systems are practically exposed?
The issue affects QuickJS-NG versions before 0.16.0 on 32-bit hosts. Exploitation requires a typed array near 2^30 elements, so systems able to allocate and process arrays of that size are the relevant exposure.
What access does an attacker need?
An attacker must be able to run JavaScript in the affected QuickJS-NG environment. No privileges or user interaction are required according to the supplied severity vector.
Is code execution guaranteed?
No. The overflow can crash the process and may potentially permit code execution; the provided data does not establish that code execution is reliable or guaranteed.