Vulnerability-Lookup

CVE-2025-62495 (GCVE-0-2025-62495)

Vulnerability from cvelistv5 – Published: 2025-10-16 15:51 – Updated: 2025-10-16 17:42

Title

Type confusion in string addition in QuickJS

Summary

An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typically 32-bit). * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow). * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative offset is then incorrectly added to the buffer pointer (s->byte\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s->byte_code.buf + pos, len);

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-16 17:40 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

Google CNA under the Google root

CNA scorecard B 77/100 over 40 records in the last 180 days details

References

2 references

URL	Tags
https://bellard.org/quickjs/Changelog
https://issuetracker.google.com/434196926

Impacted products

1 product

Vendor	Product	Version	CPE status
QuickJS	QuickJS	Affected: 2025-04-26 , < 2025-09-13 (date)	guessed

Date Public

2025-07-24 22:00

Credits

Google Big Sleep

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62495",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T17:40:14.439633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T17:42:15.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://bellard.org/quickjs/",
          "defaultStatus": "unaffected",
          "packageName": "libregexp",
          "product": "QuickJS",
          "vendor": "QuickJS",
          "versions": [
            {
              "lessThan": "2025-09-13",
              "status": "affected",
              "version": "2025-04-26",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-07-24T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn integer overflow vulnerability exists in the QuickJS regular expression engine (\u003ccode\u003elibregexp\u003c/code\u003e) due to an \u003cb\u003einconsistent representation of the bytecode buffer size\u003c/b\u003e.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe regular expression bytecode is stored in a \u003ccode\u003eDynBuf\u003c/code\u003e structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its \u003ccode\u003esize\u003c/code\u003e member.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eHowever, several functions, such as \u003ccode\u003ere_emit_op_u32\u003c/code\u003e and other internal parsing routines, incorrectly cast or store this \u003ccode\u003eDynBuf\u003c/code\u003e $\\text{size}\\_\\text{t}$ value into a signed \u003cb\u003eint\u003c/b\u003e (typically 32-bit).\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eWhen a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed \u003cb\u003e$2^{31}$ bytes\u003c/b\u003e (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a \u003cb\u003enegative integer\u003c/b\u003e when stored in the \u003ccode\u003eint\u003c/code\u003e variable (Integer Overflow).\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThis negative value is subsequently used in offset calculations. For example, within functions like \u003ccode\u003ere_parse_disjunction\u003c/code\u003e, the negative size is used to compute an offset (\u003ccode\u003epos\u003c/code\u003e) for patching a jump instruction.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThis negative offset is then incorrectly added to the buffer pointer (\u003ccode\u003es-\u0026gt;byte\\_code.buf + pos\u003c/code\u003e), leading to an \u003cb\u003eout-of-bounds write\u003c/b\u003e on the first line of the snippet below:\u003c/p\u003e\u003cblockquote\u003e\u003cp\u003e\u003ccode\u003eput_u32(s-\u0026gt;byte_code.buf + pos, len);\u003c/code\u003e\u003c/p\u003e\u003c/blockquote\u003e\u003c/li\u003e\u003c/ol\u003e\u003cbr\u003e"
            }
          ],
          "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n  *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n  *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n  *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n  *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n  *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s-\u003ebyte_code.buf + pos, len);"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T15:51:58.953Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://bellard.org/quickjs/Changelog"
        },
        {
          "url": "https://issuetracker.google.com/434196926"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Type confusion in string addition in QuickJS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-62495",
    "datePublished": "2025-10-16T15:51:58.953Z",
    "dateReserved": "2025-10-15T08:47:41.878Z",
    "dateUpdated": "2025-10-16T17:42:15.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-62495",
      "date": "2026-11-06",
      "epss": "0.00468",
      "percentile": "0.40688"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://bellard.org/quickjs/",
                "defaultStatus": "unaffected",
                "packageName": "libregexp",
                "product": "QuickJS",
                "vendor": "QuickJS",
                "versions": [
                  {
                    "lessThan": "2025-09-13",
                    "status": "affected",
                    "version": "2025-04-26",
                    "versionType": "date"
                  }
                ]
              }
            ],
            "source": "cve-coordination@google.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB84E2DC-74EA-4956-9521-C2B652B8E8C2",
                    "versionEndExcluding": "2025-09-13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n  *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n  *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n  *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n  *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n  *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s-\u003ebyte_code.buf + pos, len);"
          },
          {
            "lang": "es",
            "value": "Existe una vulnerabilidad de desbordamiento de entero en el motor de expresiones regulares QuickJS (libregexp) debido a una representaci\u00f3n inconsistente del tama\u00f1o del b\u00fafer de bytecode.\n\n  *  El bytecode de la expresi\u00f3n regular se almacena en una estructura DynBuf, que utiliza correctamente un $\\text{size}\\_\\text{t}$ (un tipo sin signo, t\u00edpicamente de 64 bits) para su miembro de tama\u00f1o.\n\n\n  *  Sin embargo, varias funciones, como re_emit_op_u32 y otras rutinas de an\u00e1lisis internas, convierten o almacenan incorrectamente este valor $\\text{size}\\_\\text{t}$ de DynBuf en un int con signo (t\u00edpicamente de 32 bits).\n\n\n  *  Cuando una expresi\u00f3n regular grande o compleja (como las generadas por un patr\u00f3n recursivo en una Prueba de Concepto) hace que el tama\u00f1o del bytecode exceda los $2^{31}$ bytes (el valor positivo m\u00e1ximo para un entero con signo de 32 bits), el valor del tama\u00f1o se ajusta, resultando en un entero negativo cuando se almacena en la variable int (Desbordamiento de Entero).\n\n\n  *  Este valor negativo se utiliza posteriormente en c\u00e1lculos de desplazamiento. Por ejemplo, dentro de funciones como re_parse_disjunction, el tama\u00f1o negativo se utiliza para calcular un desplazamiento (pos) para parchear una instrucci\u00f3n de salto.\n\n\n  *  Este desplazamiento negativo se a\u00f1ade incorrectamente al puntero del b\u00fafer (s -\u003e byte\\_code.buf + pos), lo que lleva a una escritura fuera de l\u00edmites en la primera l\u00ednea del fragmento siguiente:\n\nput_u32(s -\u003e byte_code.buf + pos, len);"
          }
        ],
        "id": "CVE-2025-62495",
        "lastModified": "2026-10-19T16:10:00.260",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cve-coordination@google.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-62495",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T17:40:14.439633Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-16T16:15:40.110",
        "references": [
          {
            "source": "cve-coordination@google.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://bellard.org/quickjs/Changelog"
          },
          {
            "source": "cve-coordination@google.com",
            "tags": [
              "Exploit",
              "Issue Tracking"
            ],
            "url": "https://issuetracker.google.com/434196926"
          }
        ],
        "sourceIdentifier": "cve-coordination@google.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-191"
              }
            ],
            "source": "cve-coordination@google.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-10-21T18:33:04+00:00",
      "cve": "CVE-2025-62495",
      "id": "CVE-2025-62495",
      "initial_release_date": "2025-07-24T22:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Type confusion in string addition in QuickJS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62495.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-62495",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-16T17:40:14.439633Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-16T17:41:50.821Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://bellard.org/quickjs/",
              "defaultStatus": "unaffected",
              "packageName": "libregexp",
              "product": "QuickJS",
              "vendor": "QuickJS",
              "versions": [
                {
                  "lessThan": "2025-09-13",
                  "status": "affected",
                  "version": "2025-04-26",
                  "versionType": "date"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Google Big Sleep"
            }
          ],
          "datePublic": "2025-07-24T22:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn integer overflow vulnerability exists in the QuickJS regular expression engine (\u003ccode\u003elibregexp\u003c/code\u003e) due to an \u003cb\u003einconsistent representation of the bytecode buffer size\u003c/b\u003e.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe regular expression bytecode is stored in a \u003ccode\u003eDynBuf\u003c/code\u003e structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its \u003ccode\u003esize\u003c/code\u003e member.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eHowever, several functions, such as \u003ccode\u003ere_emit_op_u32\u003c/code\u003e and other internal parsing routines, incorrectly cast or store this \u003ccode\u003eDynBuf\u003c/code\u003e $\\text{size}\\_\\text{t}$ value into a signed \u003cb\u003eint\u003c/b\u003e (typically 32-bit).\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eWhen a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed \u003cb\u003e$2^{31}$ bytes\u003c/b\u003e (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a \u003cb\u003enegative integer\u003c/b\u003e when stored in the \u003ccode\u003eint\u003c/code\u003e variable (Integer Overflow).\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThis negative value is subsequently used in offset calculations. For example, within functions like \u003ccode\u003ere_parse_disjunction\u003c/code\u003e, the negative size is used to compute an offset (\u003ccode\u003epos\u003c/code\u003e) for patching a jump instruction.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThis negative offset is then incorrectly added to the buffer pointer (\u003ccode\u003es-\u0026gt;byte\\_code.buf + pos\u003c/code\u003e), leading to an \u003cb\u003eout-of-bounds write\u003c/b\u003e on the first line of the snippet below:\u003c/p\u003e\u003cblockquote\u003e\u003cp\u003e\u003ccode\u003eput_u32(s-\u0026gt;byte_code.buf + pos, len);\u003c/code\u003e\u003c/p\u003e\u003c/blockquote\u003e\u003c/li\u003e\u003c/ol\u003e\u003cbr\u003e"
                }
              ],
              "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n  *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n  *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n  *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n  *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n  *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s-\u003ebyte_code.buf + pos, len);"
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-175",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-175 Code Inclusion"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "ADJACENT",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "LOW",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-191",
                  "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-16T15:51:58.953Z",
            "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
            "shortName": "Google"
          },
          "references": [
            {
              "url": "https://bellard.org/quickjs/Changelog"
            },
            {
              "url": "https://issuetracker.google.com/434196926"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Type confusion in string addition in QuickJS",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "assignerShortName": "Google",
        "cveId": "CVE-2025-62495",
        "datePublished": "2025-10-16T15:51:58.953Z",
        "dateReserved": "2025-10-15T08:47:41.878Z",
        "dateUpdated": "2025-10-16T17:42:15.865Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-62495

Vulnerability from fkie_nvd - Published: 2025-10-16 16:15 - Updated: 2026-10-19 16:10

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve-coordination@google.com	https://bellard.org/quickjs/Changelog	Release Notes
	cve-coordination@google.com	https://issuetracker.google.com/434196926	Exploit, Issue Tracking

Impacted products

	Vendor	Product	Version
	quickjs_project	quickjs	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://bellard.org/quickjs/",
          "defaultStatus": "unaffected",
          "packageName": "libregexp",
          "product": "QuickJS",
          "vendor": "QuickJS",
          "versions": [
            {
              "lessThan": "2025-09-13",
              "status": "affected",
              "version": "2025-04-26",
              "versionType": "date"
            }
          ]
        }
      ],
      "source": "cve-coordination@google.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB84E2DC-74EA-4956-9521-C2B652B8E8C2",
              "versionEndExcluding": "2025-09-13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n  *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n  *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n  *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n  *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n  *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s-\u003ebyte_code.buf + pos, len);"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de desbordamiento de entero en el motor de expresiones regulares QuickJS (libregexp) debido a una representaci\u00f3n inconsistente del tama\u00f1o del b\u00fafer de bytecode.\n\n  *  El bytecode de la expresi\u00f3n regular se almacena en una estructura DynBuf, que utiliza correctamente un $\\text{size}\\_\\text{t}$ (un tipo sin signo, t\u00edpicamente de 64 bits) para su miembro de tama\u00f1o.\n\n\n  *  Sin embargo, varias funciones, como re_emit_op_u32 y otras rutinas de an\u00e1lisis internas, convierten o almacenan incorrectamente este valor $\\text{size}\\_\\text{t}$ de DynBuf en un int con signo (t\u00edpicamente de 32 bits).\n\n\n  *  Cuando una expresi\u00f3n regular grande o compleja (como las generadas por un patr\u00f3n recursivo en una Prueba de Concepto) hace que el tama\u00f1o del bytecode exceda los $2^{31}$ bytes (el valor positivo m\u00e1ximo para un entero con signo de 32 bits), el valor del tama\u00f1o se ajusta, resultando en un entero negativo cuando se almacena en la variable int (Desbordamiento de Entero).\n\n\n  *  Este valor negativo se utiliza posteriormente en c\u00e1lculos de desplazamiento. Por ejemplo, dentro de funciones como re_parse_disjunction, el tama\u00f1o negativo se utiliza para calcular un desplazamiento (pos) para parchear una instrucci\u00f3n de salto.\n\n\n  *  Este desplazamiento negativo se a\u00f1ade incorrectamente al puntero del b\u00fafer (s -\u003e byte\\_code.buf + pos), lo que lleva a una escritura fuera de l\u00edmites en la primera l\u00ednea del fragmento siguiente:\n\nput_u32(s -\u003e byte_code.buf + pos, len);"
    }
  ],
  "id": "CVE-2025-62495",
  "lastModified": "2026-10-19T16:10:00.260",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cve-coordination@google.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-62495",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-16T17:40:14.439633Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-16T16:15:40.110",
  "references": [
    {
      "source": "cve-coordination@google.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://bellard.org/quickjs/Changelog"
    },
    {
      "source": "cve-coordination@google.com",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://issuetracker.google.com/434196926"
    }
  ],
  "sourceIdentifier": "cve-coordination@google.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-191"
        }
      ],
      "source": "cve-coordination@google.com",
      "type": "Secondary"
    }
  ]
}

GHSA-G8RQ-RJVV-4HCC

Vulnerability from github – Published: 2025-10-16 18:30 – Updated: 2025-10-29 21:30

Details

An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.

The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}_\text{t}$ (an unsigned type, typically 64-bit) for its size member.
However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}_\text{t}$ value into a signed int (typically 32-bit).
When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).
This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.
This negative offset is then incorrectly added to the buffer pointer (s->byte_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:

put_u32(s->byte_code.buf + pos, len);

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.1 (High)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-62495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-191"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-16T16:15:40Z",
    "severity": "HIGH"
  },
  "details": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n  *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n  *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n  *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n  *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n  *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s-\u003ebyte_code.buf + pos, len);",
  "id": "GHSA-g8rq-rjvv-4hcc",
  "modified": "2025-10-29T21:30:32Z",
  "published": "2025-10-16T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62495"
    },
    {
      "type": "WEB",
      "url": "https://bellard.org/quickjs/Changelog"
    },
    {
      "type": "WEB",
      "url": "https://issuetracker.google.com/434196926"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

UBUNTU-CVE-2025-62495 (CVE-2025-62495)

Vulnerability from osv_ubuntu – Published: 2025-10-16 16:15 – Updated: 2026-10-17 09:36 – Source website

Details

An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}_\text{t}$ value into a signed int (typically 32-bit). * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow). * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative offset is then incorrectly added to the buffer pointer (s->byte_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s->byte_code.buf + pos, len);

Severity

7.1 (High)


                    
                      CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

8.8 (High)


                    
                      CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-62495	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-62495	REPORT
	https://issuetracker.google.com/434196926	REPORT
	https://bellard.org/quickjs/Changelog	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libquickjs",
            "binary_version": "2021.03.27-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "quickjs",
            "binary_version": "2021.03.27-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "quickjs",
        "purl": "pkg:deb/ubuntu/quickjs@2021.03.27-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2021.03.27-1",
        "2021.03.27-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libquickjs",
            "binary_version": "2025.04.26-1"
          },
          {
            "binary_name": "quickjs",
            "binary_version": "2025.04.26-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "quickjs",
        "purl": "pkg:deb/ubuntu/quickjs@2025.04.26-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2024.01.13-5",
        "2025.04.26-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libquickjs",
            "binary_version": "2025.04.26-1build1"
          },
          {
            "binary_name": "quickjs",
            "binary_version": "2025.04.26-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "quickjs",
        "purl": "pkg:deb/ubuntu/quickjs@2025.04.26-1build1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.04.26-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libquickjs",
            "binary_version": "2025.04.26-1build1"
          },
          {
            "binary_name": "quickjs",
            "binary_version": "2025.04.26-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "quickjs",
        "purl": "pkg:deb/ubuntu/quickjs@2025.04.26-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.04.26-1",
        "2025.04.26-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.   *  The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.   *  However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).   *  When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).   *  This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.   *  This negative offset is then incorrectly added to the buffer pointer (s-\u003ebyte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s-\u003ebyte_code.buf + pos, len);",
  "id": "UBUNTU-CVE-2025-62495",
  "modified": "2026-10-17T09:36:23Z",
  "published": "2025-10-16T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-62495"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-62495"
    },
    {
      "type": "REPORT",
      "url": "https://issuetracker.google.com/434196926"
    },
    {
      "type": "REPORT",
      "url": "https://bellard.org/quickjs/Changelog"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-62495"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-62495 (GCVE-0-2025-62495)

FKIE_CVE-2025-62495

GHSA-G8RQ-RJVV-4HCC

UBUNTU-CVE-2025-62495 (CVE-2025-62495)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour