CVE-2025-46687 MEDIUM

CVE-2025-46687

Vendor Quickjs Project

Product QuickJS

Weakness CWE-770 · Uncontrolled resource consumption

Published April 27, 2025

Last update April 28, 2025

View on NVD All CVEs

CVSS base score

5.6/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Key dates

02Disclosure timeline

April 27, 2025 CVE published

April 28, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-46687 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html

Related vulnerabilities

04Related CVE

CVE-2025-59459 Denial-of-service (DoS) via resource consumption CVE-2022-32958 TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling CVE-2025-57705 QTS, QuTS hero CVE-2025-52889 Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLs CVE-2024-38535 Suricata http2: oom from duplicate headers