Vulnerability Description
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during js_print_value call.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Quickjs Project | Quickjs | < 2025-09-13 |
Related Weaknesses (CWE)
References
- https://bellard.org/quickjs/ChangelogRelease Notes
- https://issuetracker.google.com/434196651ExploitIssue Tracking
FAQ
What is CVE-2025-62490?
CVE-2025-62490 is a vulnerability with a CVSS score of 8.8 (HIGH). In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined ...
How severe is CVE-2025-62490?
CVE-2025-62490 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-62490?
Check the references section above for vendor advisories and patch information. Affected products include: Quickjs Project Quickjs.