The vulnerability resides in the js_typed_array_sort function of QuickJS, a lightweight JavaScript engine. A malformed input can trigger a heap-based buffer overflow during sorting, allowing an attacker to corrupt memory and potentially execute arbitrary code. Because the overflow occurs in a public JavaScript API, remote exploitation is feasible and a proof‑of‑concept exploit has been released.

Affected users are those running QuickJS from the quickjs-ng project, versions up to and including 0.11.0. Any deployment that incorporates these software versions without the documented patch is vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to supply malicious JavaScript executed by the engine, which is typically possible in web servers or embedded devices that expose QuickJS directly. Mitigation requires applying the fix identified by commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5 to move to a patched release.