CVE-2026-0822 MEDIUM

CVE-2026-0822: quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow

Vendor Quickjs-Ng
Product quickjs
Weakness CWE-122
Published January 10, 2026
Last update February 23, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

Key dates

02Disclosure timeline

January 10, 2026 CVE published
February 23, 2026 Record updated