Product:
QuickJS
Summary
An integer overflow vulnerability exists in the QuickJS regular expression engine due to an inconsistent representation of the bytecode buffer size. The regular expression bytecode is stored in a DynBuf structure, which uses an unsigned type for its size member. However, several functions incorrectly cast this size value into a signed int, leading to potential out-of-bounds writes when the bytecode size exceeds the maximum positive value for a signed 32-bit integer.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2025-62495 |
Exploitation
To exploit this vulnerability, an attacker can craft a large or complex regular expression that causes the bytecode size to exceed 2^31 bytes. This results in a negative integer due to the overflow, which is then used in offset calculations for buffer operations. By manipulating the offset, the attacker can trigger an out-of-bounds write, potentially leading to arbitrary code execution or data corruption.
Affected Products
- QuickJS Regular Expression Engine: Vulnerable due to improper handling of bytecode buffer size, leading to integer overflow.
Mitigation
To mitigate this vulnerability, it is recommended to update the QuickJS engine to the latest version where this issue has been addressed. Additionally, developers should ensure that size values are consistently handled as unsigned types to prevent similar vulnerabilities in the future.