CVE-2025-62493: QuickJS BigInt-to-string heap out-of-bounds read
CVE-2025-62493 is a heap out-of-bounds read in the js_bigint_to_string1 function of the QuickJS engine, caused by an off-by-one error when calculating the number of digits needed for a BigInt string conversion. The record classifies it as CWE-125 with a NVD CVSS 3.1 base score of 6.5 and a Google CVSS 4.0 score of 5.9. The sources consulted show no confirmed active exploitation and no listing in CISA KEV.
Overview
CVE-2025-62493 affects the BigInt string conversion logic (js_bigint_to_string1) in the QuickJS JavaScript engine. According to the record, the number of digits is computed with an off-by-one error, so the conversion loop can read one limb beyond the memory actually allocated for the BigInt. The record is assigned to CWE-125, Out-of-bounds Read. Sources: NVD entry and CVE Record.
Impact
- The record describes the effect as an out-of-bounds read of heap memory adjacent to the BigInt object, which may lead to information disclosure.
- NVD scores the issue as CVSS 3.1 6.5 (vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact and no integrity or availability impact.
- Google reports CVSS 4.0 5.9 in the record.
- SSVC data in the record lists technical impact as partial, and automatable as no.
Affected products and versions
The record lists the following ranges:
- QuickJS QuickJS: from 2025-04-26 (inclusive) to before 2025-09-13.
- Quickjs Project Quickjs: before 2025-09-13.
The record contains no fixed version and no patch entry. The release notes page is listed in the references, and it should be checked for the exact release that addresses this issue.
Exploitation status
The record shows CISA KEV as not listed. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc, which means the record indicates proof-of-concept availability. One reference is tagged in the record as exploit-related; its content was not analysed here. The EPSS probability is 0.00382 with a percentile of 0.30285, as recorded.
Remediation and mitigation
- Identify QuickJS builds in use, including embedded copies within other products, and compare their version or build date with the affected range.
- Plan an update to a QuickJS build dated 2025-09-13 or later, or to a vendor build that includes the upstream change. This is an inference from the affected range, since the record does not state a fixed version.
- Where immediate updating is not possible, limit exposure of the engine to untrusted input and isolate the runtime in a restricted process.
- Review the upstream changelog entry for the exact fixing release before rollout.
Detection guidance
- Inventory QuickJS dependencies with software bill of materials or build metadata to find vulnerable copies.
- Monitor for unexpected crashes, memory anomalies or abnormal output in applications that embed QuickJS and process BigInt values from untrusted sources.
- Track vendor and upstream advisories for updates to the record.
Limitations of the available information
The record does not provide a fixed version, a proof of concept assessment beyond the SSVC field, a vendor advisory, or confirmation of real-world exploitation. The record's EPSS date is listed as 2026-10-13, and this date was reported as recorded without independent verification. The description includes formula and code fragments that were summarised here without reproducing exploit details.
Frequently asked questions
What is CVE-2025-62493?
It is a heap out-of-bounds read in the BigInt-to-string conversion function js_bigint_to_string1 of the QuickJS engine, caused by an off-by-one error in digit calculation.
Is this vulnerability known to be exploited?
The record shows CISA KEV as not listed, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.