Product:
QuickJS
Summary
A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine’s implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. If the negative value is extremely small, it can result in a loss of precision, yielding an outcome that is equal to the length of the array. This allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer, potentially leading to Information Disclosure of adjacent memory contents.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2025-62492 |
Exploitation
To exploit this vulnerability, an attacker can supply a negative fromIndex argument that is extremely small when calling the TypedArray.prototype.indexOf() method. This will cause the calculated starting index for the search to be equal to the length of the array, leading to an Out-of-Bounds Read. The attacker can then read adjacent memory contents, which may contain sensitive information depending on the execution environment.
Affected Products
- QuickJS: Vulnerable due to floating-point arithmetic precision errors in TypedArray.prototype.indexOf() when using a negative fromIndex.
Mitigation
To mitigate this vulnerability, it is recommended to validate the fromIndex argument before using it in the TypedArray.prototype.indexOf() method. Ensuring that the fromIndex is within valid bounds can prevent the Out-of-Bounds Read and protect against potential information disclosure.