A use‑after‑free flaw is found in the js_iterator_concat_return function in quickjs.c of quickjs‑ng quickjs versions up to 0.12.1; the flaw allows local attackers to trigger memory corruption by providing crafted input, which can lead to process crashes or, in some situations, uncontrolled execution within the process. The vulnerability is classified as CWE‑416 and CWE‑119. The vendor indicates that an arbitrary pointer can be freed twice, enabling arbitrary memory writes.

All installations of quickjs‑ng quickjs with version 0.12.1 or earlier are affected, including any environment that embeds or links against the library regardless of operating system because the defect resides in the core quickjs.c source.

The CVSS score of 4.8 denotes a moderate severity while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation; the vulnerability is not listed in the CISA KEV catalog. An exploit has been published, and the attack requires local access to the environment in which the engine runs, meaning that any user who can invoke the JavaScript engine with crafted input can exploit the flaw.