Bug 2428463 (CVE-2026-0822) - CVE-2026-0822 quickjs-ng: quickjs-ng: Heap-based buffer overflow in js_typed_array_sort function
Summary: CVE-2026-0822 quickjs-ng: quickjs-ng: Heap-based buffer overflow in js_typed_...
Keywords:
Status: NEW
Alias: CVE-2026-0822
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2428530 2428532 2428534 2428536 2428538
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-10 14:01 UTC by OSIDB Bzimport
Modified: 2026-01-11 07:30 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-10 14:01:29 UTC 
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.
Note You need to log in before you can comment on or make changes to this bug.