CVE-2025-62496 Integer overflow in js_bigint_from_string in QuickJS
An integer overflow in QuickJS BigInt parsing leads to heap out-of-bounds writes, potentially allowing code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-62496?
CVE-2025-62496 is a high-severity vulnerability in QuickJS, published on 16 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits.
The function calculates the necessary number of bits (n_bits) required to store the BigInt using the formula:
$$\text{n\_bits} = (\text{n\_digits} \times 27 + 7) / 8 \quad (\text{for radix 10})$$
* For large input strings (e.g., $79,536,432$ digits or more for base 10), the intermediate calculation $(\text{n\_digits} \times 27 + 7)$ exceeds the maximum value of a standard signed 32-bit integer, resulting in an Integer Overflow.
* The resulting n_bits value becomes unexpectedly small or even negative due to this wrap-around.
* This flawed n_bits is then used to compute n_limbs, the number of memory "limbs" needed for the BigInt object. Since n_bits is too small, the calculated n_limbs is also significantly underestimated.
* The function proceeds to allocate a JSBigInt object using this underestimated n_limbs.
* When the function later attempts to write the actual BigInt data into the allocated object, the small buffer size is quickly exceeded, leading to a Heap Out-of-Bounds Write as data is written past the end of the allocated r->tab array.
Weakness: CWE-190
Which versions are affected by CVE-2025-62496?
It affects 1 product.
Products include Quickjs Project Quickjs.
How do I fix CVE-2025-62496?
No fix has been published for CVE-2025-62496 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62496 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62496 exists.
Other vulnerabilities in QuickJS
Sources
Also known as DEBIAN-CVE-2025-62496, GHSA-p8pr-fr36-rgmq, UBUNTU-CVE-2025-62496.