Product:
QuickJS
Summary
A vulnerability exists in the QuickJS engine’s BigInt string conversion logic due to an incorrect calculation of the required number of digits. This leads to reading memory past the allocated BigInt structure, which can result in information disclosure of sensitive data stored on the heap adjacent to the BigInt object. The issue arises from an off-by-one error in the calculation of the necessary memory limbs.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2025-62493 |
Exploitation
To exploit this vulnerability, an attacker can craft a BigInt that triggers the incorrect calculation of the number of digits needed for its string representation. By carefully manipulating the input, the attacker can cause the conversion loop to read beyond the allocated memory for the BigInt, accessing adjacent memory locations. This can lead to the disclosure of sensitive information stored in those locations.
Affected Products
- QuickJS: A lightweight JavaScript engine that is vulnerable due to its BigInt string conversion logic.
Mitigation
To mitigate this vulnerability, it is recommended to update the QuickJS engine to the latest version where the issue has been addressed. Additionally, developers should review their use of BigInt and ensure proper bounds checking is implemented to prevent out-of-bounds reads.