Description
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| quickjs-ng | quickjs | 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | quickjs | No fix yet | — |
| Debian 13 | quickjs | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | quickjs | No fix yet | — |
| Ubuntu 25.10 | quickjs | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | quickjs | 20260604-1.1 | openSUSE-SU-2026:11037-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | quickjs-ng | 0.11.0-r2 | — |
| Alpine v3.23 | quickjs-ng | 0.11.0-r1 | — |
Advisories 1
- openSUSE-SU-2026:11037-1 quickjs-20260604-1.1 on GA media SUSE / openSUSE Security Updates · Jun 16, 2026
References
- VDB-341737 | quickjs-ng quickjs Atomics Ops quickjs.c use after free vdb-entry technical-description
- VDB-341737 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #735537 | quickjs-ng quickjs v0.11.0 Use After Free third-party-advisory
- Submit #735538 | quickjs-ng quickjs v0.11.0 Use After Free (Duplicate) third-party-advisory
- https://github.com/quickjs-ng/quickjs/issues/1301 issue-tracking
- https://github.com/quickjs-ng/quickjs/pull/1303 issue-tracking
- https://github.com/quickjs-ng/quickjs/issues/1302 exploit issue-tracking
- https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 patch
- https://github.com/quickjs-ng/quickjs/ product