CVE-2025-62494
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
- EPSS probability
- 0.48%
- CWE
- CWE-704
- Published
- 2025-10-16
- Last modified
- 2026-03-12
Affected products
- QuickJS QuickJS
Weakness type
Related vulnerabilities
- CVE-2026-87546 — Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-69585 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-50278 — iccDEV: CIccEmbedIO::Read8() size_t underflow
- CVE-2026-10080 — Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-15826 — User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
- CVE-2026-53798 — rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
- CVE-2026-73429 — Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
- CVE-2026-18675 — Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid