MEDIUMCVSS 5.5
MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.
Published 2026-11-15 · last modified 2026-11-15
| Vendor | Product |
|---|---|
| bellard | mquickjs |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.