CVE-2026-0822 quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow

Medium 5.3 Published 10 Jan 2026 Updated 23 Feb 2026

A heap-based buffer overflow in the quickjs-ng JavaScript engine allows remote attackers to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-0822?

CVE-2026-0822 is a medium-severity memory corruption vulnerability in quickjs-ng quickjs, published on 10 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

Weakness: CWE-122, CWE-787, CWE-119

Which versions are affected by CVE-2026-0822?

It affects 1 product.

Products include Quickjs-Ng Quickjs.

How do I fix CVE-2026-0822?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-0822 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0822 exists.

Sources

Also known as ALPINE-CVE-2026-0822, DEBIAN-CVE-2026-0822, GHSA-67vh-536w-6pc4, UBUNTU-CVE-2026-0822.