Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-88378: QuickJS can overwrite memory, risking unauthorized code execution
CVE-2026-88378 · published 25 days ago
Summary
A coding error in QuickJS (including the Debian and quickjs‑ng packages) can write data outside its intended area when reading a function tag, which could let an attacker run their own code. Update to the latest version of QuickJS or apply the vendor’s patch as soon as possible. Until then, avoid running untrusted JavaScript code with this library.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:24.04:LTS | canonical | quickjs | All versions |
| Debian:13 | debian | quickjs | All versions |
| Debian:14 | debian | quickjs-ng | All versions |
Original advisory text
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
References
- https://github.com/bellard/quickjs/issues/549
- https://github.com/bellard/quickjs/pull/553
- https://github.com/bellard/quickjs/pull/553/changes/42526037cfc0b2a94a875c0de0f4...
- https://security-tracker.debian.org/tracker/CVE-2026-88378 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-88378 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-88378 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Sources
CVE-2026-88378 · NVD
CVE-2026-88378 · MITRE
UBUNTU-CVE-2026-88378 · OSV
DEBIAN-CVE-2026-88378 · OSV
Track software like this
Free during beta