QuickJS contains a heap out‑of‑bounds write condition in the JS_ReadFunctionTag() routine. The flaw permits an attacker to overwrite adjacent memory structures after a malformed function tag is parsed, potentially corrupting the heap. The CVE description does not state that this leads to arbitrary code execution, but heap corruption could undermine the confidentiality, integrity, or availability of the host application if the attacker can influence the parsing environment. The weakness corresponds to the heap‑based buffer overflow class (CWE‑787).

All deployments that embed QuickJS before commit 04be24600 are affected. This includes lightweight web runtimes, scripting extensions, or embedded devices that rely on the unpatched engine.

The EPSS score is very low (< 1%) and the vulnerability is not listed in CISA's KEV catalog, indicating a presently low likelihood of exploitation. The description shows a heap out‑of‑bounds write in JS_ReadFunctionTag(), which could corrupt the heap if fed malformed function tags. While the CVE does not explicitly state that it leads to arbitrary code execution, such corruption could potentially compromise confidentiality, integrity, or availability of the host application if the attacker is able to control the parsing environment. The CVSS score of 9.8 indicates a critical level of risk.