CVE-2024-13903
Published: 21 March 2025
Summary
CVE-2024-13903 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Quickjs-Ng Quickjs. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely patching and remediation of known flaws like this stack-based buffer overflow in QuickJS, preventing exploitation via upgrade to version 0.9.0.
Implements memory protection mechanisms such as stack canaries, ASLR, and DEP that directly mitigate stack-based buffer overflows by preventing unauthorized memory execution or overflow exploitation.
Enables vulnerability scanning to identify the presence of CVE-2024-13903 in deployed QuickJS components, facilitating remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in QuickJS qjs component enables remote denial of service via crafted JavaScript input causing application crash, facilitating T1499.004 (Application or System Exploitation).
NVD Description
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. The…
more
attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The patch is named 99c02eb45170775a9a679c32b45dd4000ea67aff. It is recommended to upgrade the affected component.
Deeper analysisAI
CVE-2024-13903 is a stack-based buffer overflow vulnerability affecting the quickjs-ng QuickJS JavaScript engine in versions up to 0.9.0. The issue resides in the JS_GetRuntime function within the quickjs.c file of the qjs component. Manipulation of this function triggers the overflow, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), indicating moderate severity primarily impacting availability.
The vulnerability can be exploited remotely by unauthenticated attackers over a network with low complexity, but it requires user interaction to trigger. Successful exploitation results in limited denial-of-service effects, such as application crashes due to the stack overflow, with no impact on confidentiality or integrity.
Mitigation is addressed by upgrading to QuickJS version 0.9.0, which includes the fixing commit 99c02eb45170775a9a679c32b45dd4000ea67aff. Additional details are available in the project's GitHub issue #775 and release notes for v0.9.0.
Details
- CWE(s)