UBUNTU-CVE-2026-120440: Medium severity ubuntu/quickjs-ng vulnerability
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in jsatomicsstore() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using QuickJS-NG versions before 0.16.0 are exposed if an attacker can run JavaScript in the affected runtime. The issue can be used to exhaust heap memory and cause denial of service.
What does an attacker need to exploit it?
The attacker needs the ability to execute JavaScript. They can repeatedly invoke Atomics.store with a valueOf operation that detaches or shrinks the buffer, causing the affected error path to leak memory.
What should be done if an immediate update is not possible?
Limit or disable execution of untrusted JavaScript in affected QuickJS-NG deployments where possible. Restricting attacker-controlled scripts reduces the ability to repeatedly trigger the memory leak.