A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits.
The function calculates the necessary number of bits (n_bits) required to store the BigInt using the formula:
$$\text{n\_bits} = (\text{n\_digits} \times 27 + 7) / 8 \quad (\text{for radix 10})$$
* For large input strings (e.g., $79,536,432$ digits or more for base 10), the intermediate calculation $(\text{n\_digits} \times 27 + 7)$ exceeds the maximum value of a standard signed 32-bit integer, resulting in an Integer Overflow.
* The resulting n_bits value becomes unexpectedly small or even negative due to this wrap-around.
* This flawed n_bits is then used to compute n_limbs, the number of memory "limbs" needed for the BigInt object. Since n_bits is too small, the calculated n_limbs is also significantly underestimated.
* The function proceeds to allocate a JSBigInt object using this underestimated n_limbs.
* When the function later attempts to write the actual BigInt data into the allocated object, the small buffer size is quickly exceeded, leading to a Heap Out-of-Bounds Write as data is written past the end of the allocated r->tab array.
References
| Link | Resource |
|---|---|
| https://bellard.org/quickjs/Changelog | Release Notes |
| https://issuetracker.google.com/434193016 | Exploit Issue Tracking |
Configurations
History
28 Oct 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Quickjs Project quickjs
Quickjs Project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://bellard.org/quickjs/Changelog - Release Notes | |
| References | () https://issuetracker.google.com/434193016 - Exploit, Issue Tracking | |
| CPE | cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
16 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-16 16:15
Updated : 2025-10-28 18:17
NVD link : CVE-2025-62496
Mitre link : CVE-2025-62496
CVE.ORG link : CVE-2025-62496
JSON object : View
Products Affected
quickjs_project
- quickjs
CWE
CWE-190
Integer Overflow or Wraparound