The flaw occurs in the js_typed_array_constructor function of the QuickJS JavaScript engine, where a crafted manipulation can create a heap-based buffer overflow. This overflow can corrupt memory and may enable an attacker to execute arbitrary code, although the description does not explicitly state an execution failure. The vulnerability is exploitable remotely and has been publicly disclosed.

QuickJS from quickjs-ng is affected, specifically all releases up to and including version 0.11.0. No other vendor or product versions are listed in the CNA data.

The CVSS base score of 6.9 indicates a moderate to high severity, while the EPSS score of less than 1% shows that active exploitation is presently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can likely invoke the flaw remotely by sending specially crafted data to the typed array constructor, leading to heap corruption and potentially code execution if memory is abused.