CVE-2025-62493 Heap out-of-bounds read in js_bigint_to_string1 in QuickJS
An out-of-bounds read in QuickJS allows attackers to disclose sensitive heap memory adjacent to BigInt objects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-62493?
CVE-2025-62493 is a medium-severity vulnerability in QuickJS, published on 16 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure.
* The function determines the number of characters (n_digits) needed for the string representation by calculating:
$$ \\ \text{n\_digits} = (\text{n\_bits} + \text{log2\_radix} - 1) / \text{log2\_radix}$$
$$$$This formula is off-by-one in certain edge cases when calculating the necessary memory limbs. For instance, a 127-bit BigInt using radix 32 (where $\text{log2\_radix}=5$) is calculated to need $\text{n\_digits}=26$.
* The maximum number of bits actually stored is $\text{n\_bits}=127$, which requires only two 64-bit limbs ($\text{JS\_LIMB\_BITS}=64$).
* The conversion loop iterates $\text{n\_digits}=26$ times, attempting to read 5 bits in each iteration, totaling $26 \times 5 = 130$ bits.
* In the final iterations of the loop, the code attempts to read data that spans two limbs:
C
c = (r->tab[pos] >> shift) | (r->tab[pos + 1] << (JS_LIMB_BITS - shift));
* Since the BigInt was only allocated two limbs, the read operation for r->tab[pos + 1] becomes an Out-of-Bounds Read when pos points to the last valid limb (e.g., $pos=1$).
This vulnerability allows an attacker to cause the engine to read and process data from the memory immediately following the BigInt buffer. This can lead to Information Disclosure of sensitive data stored on the heap adjacent to the BigInt object.
Weakness: CWE-125
Which versions are affected by CVE-2025-62493?
It affects 1 product.
Products include Quickjs Project Quickjs.
How do I fix CVE-2025-62493?
No fix has been published for CVE-2025-62493 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62493 exists.
Other vulnerabilities in QuickJS
Sources
Also known as DEBIAN-CVE-2025-62493, GHSA-pff3-r4r5-gmxp, UBUNTU-CVE-2025-62493.