CVE-2025-65570 Memory corruption in n/a
A type confusion in the jsish JavaScript engine allows attackers to cause crashes or execute arbitrary code via crafted instanceof expressions in for-in loops.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65570?
CVE-2025-65570 is a critical memory corruption vulnerability in Jsish Jsish, published on 29 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.
Weakness: CWE-843
Which versions are affected by CVE-2025-65570?
It affects 1 product.
Products include Jsish Jsish.
How do I fix CVE-2025-65570?
No fix has been published for CVE-2025-65570 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-65570 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65570 exists.
Other vulnerabilities in Jsish Jsish
Sources
Also known as GHSA-r6xg-3mr4-3226.