QuickJS‑NG before version 0.16.0 contains an integer overflow in the js_typed_array_sort function that can be triggered by calling TypedArray.prototype.sort with a custom comparator on a typed array approaching two to the thirty‑second elements. The overflow wraps the allocation size, allowing the routine to write indices beyond the intended buffer, which can result in a crash or, if exploited further, execution of arbitrary code on the host. The flaw violates integrity and may provide an attacker with full code‑execution capabilities on 32‑bit systems where the overflow resolves to a smaller allocation.

Any installation of QuickJS‑NG with a version earlier than 0.16.0 that runs on a 32‑bit host is vulnerable. The vulnerability is tied to the QuickJS‑NG library itself and does not depend on specific operating system distributions or client platforms; any application that embeds or interprets JavaScript via this library can be affected.

The CVSS score of 8.3 indicates a high‑severity flaw, while the EPSS score is not publicly available, leaving the likelihood of exploitation uncertain but not negligible. The vulnerability is not yet listed in CISA’s KEV catalog. An attacker must be able to execute arbitrary JavaScript within the context of the vulnerable QuickJS‑NG instance; typical vectors include malicious web pages or scripts loaded into a vulnerable application. Once the attacker can run such code, they can trigger the heap buffer overflow and potentially gain code‑execution rights.