DEBIAN-CVE-2026-1144

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-1144

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1144.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-1144

Upstream

CVE-2026-1144

Published

2026-01-19T08:16:04.857Z

Modified

2026-01-31T10:16:21.855273Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141. Applying a patch is advised to resolve this issue.

References

https://security-tracker.debian.org/tracker/CVE-2026-1144

Affected packages

Debian:13 / quickjs

Package

Name: quickjs
Purl: pkg:deb/debian/quickjs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2025.*

2025.04.26-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1144.json"

Debian:14 / quickjs