Cyber Posture

CVE-2026-0822

MediumPublic PoC

Published: 10 January 2026

Published
10 January 2026
Modified
23 February 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS Score 0.0006 19.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0822 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Quickjs-Ng Quickjs. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-119 CWE-787

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

addresses: CWE-119

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
Why these techniques?

Heap buffer overflow in JS engine enables client-side code execution via crafted input (T1203); remote delivery with UI:R supports drive-by attacks (T1189).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and…

more

might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.

Deeper analysisAI

CVE-2026-0822 is a heap-based buffer overflow vulnerability in the js_typed_array_sort function of the quickjs.c file in the quickjs-ng quickjs engine, affecting versions up to 0.11.0. The issue, associated with CWEs-119, CWE-122, and CWE-787, was published on 2026-01-10 and carries a CVSS v3.1 base score of 6.3.

Remote attackers can exploit this vulnerability with network access, low attack complexity, no privileges required, but user interaction is necessary (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). By manipulating input to trigger the buffer overflow, attackers may achieve limited impacts on confidentiality, integrity, and availability. A public exploit is available and might be used.

Mitigation involves deploying the patch at commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5, as recommended in the quickjs-ng repository. Related GitHub resources include the repository, the patch commit, issue #1297, a comment on that issue, and pull request #1298.

Details

CWE(s)

Affected Products

quickjs-ng
quickjs
≤ 0.11.0

CVEs Like This One

CVE-2026-1145Same product: Quickjs-Ng Quickjs
CVE-2026-0821Same product: Quickjs-Ng Quickjs
CVE-2024-13903Same product: Quickjs-Ng Quickjs
CVE-2026-1144Same product: Quickjs-Ng Quickjs
CVE-2026-2314Shared CWE-122, CWE-787
CVE-2026-4673Shared CWE-122, CWE-787
CVE-2026-1861Shared CWE-122, CWE-787
CVE-2026-3544Shared CWE-122, CWE-787
CVE-2026-3913Shared CWE-122, CWE-787
CVE-2026-3931Shared CWE-122, CWE-787

References