CVE-2025-71470

CVSS 6.8 (medium) · published 2026-11-15

MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.

Weakness: CWE-125

Source: NVD CVE-2025-71470

References

• https://github.com/bellard/mquickjs/commit/99eed3f94cb66ea7e02fd3472ca7374dee31bb89
• https://github.com/bellard/mquickjs/issues/24
• https://github.com/sigdevel/pocs/blob/main/res/mquickjs/1/mquickjs_c_3981
• https://www.vulncheck.com/advisories/microquickjs-before-commit-99eed3f-out-of-bounds-read-in-build-backtrace

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.