CVE-2026-120438
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Nov 2, 2026
CISA due date
—
The record
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-108324 Tanium addressed a denial of service vulnerability in Tanium Client. CWE-190
- CVE-2026-121219 Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker… CWE-190
- CVE-2026-121382 A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. CWE-190
- CVE-2026-120954 A weakness in the BSON library's handling of a specialized binary vector data type allows… CWE-190
- CVE-2026-63418 Monitoring Plugins is a suite of plugins for monitoring applications. CWE-190
- CVE-2026-121259 A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. CWE-190
- CVE-2026-40659 An integer overflow condition in the AMD Compressonator SDK could allow an attacker with… CWE-190
- CVE-2026-100493 An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an… CWE-190