A buffer overflow results from an integer overflow in js_proxy_get_own_property_names between proxies and ownKeys traps, leading to heap corruption on 32‑bit hosts. An attacker that can execute JavaScript within QuickJS‑NG can engineer a Proxy whose ownKeys trap returns a very large array‑like object, causing a malformed allocation that may crash the engine or, in worst‑case, allow the attacker to execute arbitrary code. The vulnerability is identified as CWE‑190, input integer overflow.

All builds of QuickJS‑NG version 0.15.1 and earlier, specifically running on 32‑bit platforms, are affected. The product is QuickJS‑NG, a lightweight JavaScript engine, and the issue is present in the core runtime before the 0.16.0 release. Users on 64‑bit hosts are not impacted because the overflow is limited to 32‑bit integer arithmetic.

The CVSS score of 8.5 places it in the high severity range, and while the EPSS score is not available, the lack of a KEV listing does not reduce the need for action. The attack vector requires the attacker to run JavaScript in the vulnerable host, so compromise of the host or injection of custom scripts is necessary to trigger the flaw. If achieved, the bug could lead to denial of service through crashes or, depending on implementation, remote code execution via the corrupted heap. The impact is therefore significant for any service that embeds or executes untrusted JavaScript with QuickJS‑NG.