CVE-2025-12745CWE-119CWE-125CWE-126

CVE-2025-12745

Medium · published November 6, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery Patch name: c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea. To fix this issue, it is recommended to deploy a patch.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125 · Out-of-bounds Read; CWE-126 · Buffer Over-read
Published
2025-11-06T00:15Z
Affected products (1)
ProductVersionsFixed in
bellard/quickjs< 2025-11-032025-11-03
References (10)
https://github.com/bellard/quickjs/commit/c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea · [email protected]https://github.com/bellard/quickjs/issues/451 · [email protected]https://github.com/bellard/quickjs/issues/451#issue-3533698042 · [email protected]https://github.com/bellard/quickjs/issues/451#issuecomment-3481807558 · [email protected]https://vuldb.com/?ctiid.331268 · [email protected]https://vuldb.com/?id.331268 · [email protected]https://vuldb.com/?submit.678850 · [email protected]https://github.com/bellard/quickjs/issues/451 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/bellard/quickjs/issues/451#issue-3533698042 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/bellard/quickjs/issues/451#issuecomment-3481807558 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 NOV 18:32Z
    QuickJS quickjs.c js_array_buffer_slice buffer over-read
    cvelistv5