DEBIAN-CVE-2026-0822

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-0822

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0822.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-0822

Upstream

CVE-2026-0822

Published

2026-01-10T14:15:50.087Z

Modified

2026-01-11T11:07:58.400859Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

[none]

Details

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function jstypedarray_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

References

https://security-tracker.debian.org/tracker/CVE-2026-0822

Affected packages

Debian:13 / quickjs

Package

Name: quickjs
Purl: pkg:deb/debian/quickjs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2025.*

2025.04.26-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0822.json"

Debian:14 / quickjs