CVE-2026-0822

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

• CWE-119
• CWE-122
• CWE-787

• https://github.com/quickjs-ng/quickjs/
• https://github.com/quickjs-ng/quickjs/commit/53eefbcd695165a3bd8c584813b472cb4a69fbf5Patch
• https://github.com/quickjs-ng/quickjs/issues/1297Exploit, Issue Tracking, Vendor Advisory
• https://github.com/quickjs-ng/quickjs/issues/1297#issue-3780006202Exploit, Issue Tracking, Vendor Advisory
• https://github.com/quickjs-ng/quickjs/pull/1298Issue Tracking
• https://vuldb.com/?ctiid.340356Permissions Required, VDB Entry
• https://vuldb.com/?id.340356Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.731783Third Party Advisory, VDB Entry

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0816The All push notification for WP plugin for WordPress is vul…4.9
• CVE-2026-0817Missing Authorization vulnerability in Wikimedia Foundation …5.3
• CVE-2026-0818When a user explicitly requested Thunderbird to decrypt an i…4.3
• CVE-2026-0819A stack buffer overflow vulnerability exists in wolfSSL's PK…7.1
• CVE-2026-0820The RepairBuddy – Repair Shop CRM & Booking Plugin for WordP…4.3
• CVE-2026-0821A vulnerability was determined in quickjs-ng quickjs up to 0…9.8
• CVE-2026-0823Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-0824A security flaw has been discovered in questdb ui up to 1.11…3.5
• CVE-2026-0825The Database for Contact Form 7, WPforms, Elementor forms pl…5.3
• CVE-2026-0826In certain scenarios when the admin has enabled Interactive …9.2
• CVE-2026-0827During an internal security assessment, a potential vulnerab…7.1
• CVE-2026-0828Kernel driver ProcessMonitorDriver.sys in Safetica's endpoin…7.5