CVE-2026-120438
Description
A flaw was found in QuickJS-NG. This vulnerability allows an attacker executing JavaScript code to potentially achieve arbitrary code execution or cause a denial of service (DoS) through an application crash. The issue occurs due to an integer overflow during proxy property enumeration on 32-bit systems, which triggers a heap-based buffer overflow when an oversized array-like object is processed.
Statement
Red Hat rates the impact of this vulnerability as Important because an unprivileged local attacker executing untrusted JavaScript can corrupt heap memory and potentially achieve arbitrary code execution within the context of the host application. Although code execution is theoretically possible, exploitation is constrained by the requirement that the host application evaluate untrusted input and is predominantly viable on 32-bit platforms where integer wrapping occurs during proxy property handling. Standard 64-bit enterprise deployments naturally resist this integer overflow mechanism, substantially reducing practical risk across supported platforms.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unverified size arithmetic during proxy property enumeration in QuickJS-NG by enforcing incremental reallocation and overflow checks: upgrade to quickjs-ng 0.16.0 (or the fixed Quickjs Ng/Radare builds), which replace upfront single allocation with incremental reallocation bounded by overflow checks against SIZE_MAX, closing Proxy ownKeys trap returning an oversized array-like object. Until patched, this is only a concern on 32-bit deployments executing untrusted JavaScript within QuickJS-NG — standard 64-bit enterprise deployments are unaffected — so restrict the execution of untrusted JavaScript code or deploy the host application on 64-bit architectures. As a compensating measure, enable Address Space Layout Randomization to randomize process memory layout and complicate reliable heap exploitation, enable Full RELRO and PIE to protect the Global Offset Table from overwrite via corrupted function pointers, enforce Control Flow Integrity or Shadow Call Stack to restrict execution flow to valid call targets and mitigate hijacking, and enforce NX/XD Bit to prevent direct code execution from corrupted heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
