A heap-based buffer overflow was discovered in the function js_typed_array_constructor_ta within quickjs-ng quickjs up to version 0.11.0. The flaw causes a heap-based buffer overflow when the function is invoked with certain parameters. The CVE states that the attack can be carried out remotely. While the CVE does not explicitly state the resulting impact, such memory corruption could lead to process crashes or, potentially, arbitrary code execution. The possibility of arbitrary code execution is inferred from the nature of heap-based overflows but is not confirmed in the provided data.

The affected product is QuickJS, an ECMAScript engine developed by quickjs-ng. Versions up to 0.11.0 are vulnerable. The commit that introduces the fix is 53aebe66170d545bb6265906fe4324e4477de8b4. Systems that embed QuickJS or rely on its typed array handling should verify their installed version against this range.

The CVSS score is 5.3, placing the issue in the moderate severity range. The EPSS score is below 1%, indicating a low likelihood of mass exploitation, but the presence of a publicly published exploit and the fact that attack vectors are remote raise the practical risk. The vulnerability is not listed in CISA’s KEV catalog, which suggests it is not widely exploited in the wild at this time. Based on the description, it is inferred that an attacker might trigger the overflow remotely by presenting malicious typed array input, making the exploitation path seemingly straightforward for applications that embed QuickJS.