Security readout for executives and security teams
Plain-English summary
CVE-2026-0822 is a heap-based buffer overflow in quickjs-ng QuickJS, a JavaScript engine. Affected versions are listed through 0.11.0. The issue can be triggered remotely according to the advisory, and public proof-of-concept material is referenced. No source provided indicates active exploitation. Organizations embedding QuickJS should prioritize identifying affected deployments and applying the vendor patch commit or later guidance.
Executive priority
Prioritize this as high if QuickJS processes untrusted JavaScript, especially in exposed services or shared environments. The combination of memory corruption, remote exploitability, and public exploit material warrants fast remediation. If QuickJS is only used in isolated internal tooling with trusted inputs, urgency is lower but patching remains recommended.
Technical view
The flaw affects js_typed_array_sort in quickjs.c and is classified as CWE-119/CWE-122. VulDB assigns CVSS 7.5 with network attack vector, low complexity, and partial confidentiality, integrity, and availability impact. The referenced fix is commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5. Evidence identifies quickjs-ng quickjs versions 0.1 through 0.11.0 as affected.
Likely exposure
Exposure is most likely where quickjs-ng QuickJS is embedded in applications, services, appliances, automation platforms, or tooling that processes untrusted JavaScript or user-controlled inputs. Direct exposure depends on how the engine is integrated and whether attackers can reach JavaScript execution paths.
Exploitation context
Sources state remote exploitation is possible and that an exploit is publicly available. The CVE is not marked KEV in the provided data, and no cited source confirms active in-the-wild exploitation. Treat public proof-of-concept availability as increasing urgency, especially for internet-facing or multi-tenant use cases.
Researcher notes
The public record names the vulnerable function and patch commit but does not provide complete downstream impact mapping. Validate exposure by integration context, not just package presence. Avoid assuming active exploitation without new evidence. Track GitHub issue 1297, pull request 1298, and the patch commit for authoritative implementation details.
Mitigation direction
- Inventory applications and products embedding quickjs-ng QuickJS.
- Identify versions 0.1 through 0.11.0 in source, binaries, SBOMs, or vendor disclosures.
- Apply the referenced patch commit or an upstream release containing it.
- If using third-party products, request vendor confirmation and update timelines.
- Restrict untrusted JavaScript processing until patched where feasible.
Validation and detection
- Confirm quickjs-ng QuickJS presence and exact version in deployed components.
- Verify whether commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5 is included.
- Review dependency manifests, SBOMs, and build artifacts for bundled QuickJS copies.
- Check upstream issue and pull request status for fix integration details.
- Document whether untrusted users can trigger typed array sorting paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0822 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C106.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
7.5HighVector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- VDB-340356 | quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflowCVE reference · vdb-entry, technical-description
- VDB-340356 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #731783 | quickjs-ng quickjs v0.11.0 Heap-based Buffer OverflowCVE reference · third-party-advisory
- https://github.com/quickjs-ng/quickjs/issues/1297CVE reference · issue-tracking, exploit
- https://github.com/quickjs-ng/quickjs/pull/1298CVE reference · issue-tracking
- https://github.com/quickjs-ng/quickjs/commit/53eefbcd695165a3bd8c584813b472cb4a69fbf5CVE reference · patch
- https://github.com/quickjs-ng/quickjs/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.