A use‑after‑free flaw (CWE‑416) has been identified in the Atomics Ops handler inside quickjs.c of quickjs‑ng quickjs up to version 0.11.0. When an attacker manipulates the relevant function, the execution path references freed memory, potentially corrupting the runtime state. The CVE entry states that the attack can be executed remotely and that an exploit is publicly available, but it does not explicitly claim arbitrary code execution; the primary impact is memory corruption that could lead to unintended behavior.

The vulnerability affects the quickjs‑ng quickjs product for all releases through 0.11.0. The specific subcomponent is the Atomics Ops handler in quickjs.c, though no finer‑grained NVD or vendor data specifies a narrower scope. Systems that expose the Atomics Ops interface to external callers are the ones at risk.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the open network. This issue is not listed in the CISA KEV catalog. Attackers can trigger the use‑after‑free from a remote location as the proof‑of‑concept code is publicly posted in the project's GitHub repository. While the immediate threat level is moderate, the potential for serious compromise justifies taking remediation action promptly.