CVE-2025-62491
Full vulnerability record from the local CVENow database.
Description
A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop. * The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp->reason). * If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process. * The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed. * Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list. * Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition.
Severity
HIGH
CVSS score
8.8
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-16 16:15:39.470000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-62491",
"sourceIdentifier": "[email protected]",
"published": "2025-10-16T16:15:39.470",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list).\n\n * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop.\n\n\n * The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp->reason).\n\n\n * If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process.\n\n\n * The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed.\n\n\n * Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list.\n\n\n * Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition."
},
{
"lang": "es",
"value": "Una vulnerabilidad de uso después de liberación (UAF) existe en la biblioteca estándar del motor QuickJS al iterar sobre la lista global de promesas rechazadas no manejadas (ts -> rejected_promise_list).\n\n * La función js_std_promise_rejection_check intenta iterar sobre la rejected_promise_list para informar rechazos no manejados utilizando un bucle de lista estándar.\n\n * La razón de un rechazo de promesa se procesa dentro del bucle, incluyendo la llamada a js_std_dump_error1(ctx, rp -> reason).\n\n * Si la razón del rechazo de la promesa es un objeto Error que define un getter de propiedad personalizado (por ejemplo, a través de Object.defineProperty), este getter se ejecuta durante el proceso de volcado de errores.\n\n * El getter personalizado malicioso puede ejecutar código JavaScript que llama a catch() en la misma promesa rechazada que se está procesando.\n\n * La llamada a catch() internamente activa js_std_promise_rejection_tracker, que luego elimina y libera la entrada de promesa actual (JSRejectedPromiseEntry) de la rejected_promise_list.\n\n * Dado que la iteración de la lista continúa utilizando el puntero de memoria ahora liberado (el), el acceso posterior del bucle resulta en una condición de uso después de liberación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "QuickJS",
"product": "QuickJS",
"defaultStatus": "unaffected",
"collectionURL": "https://bellard.org/quickjs/",
"packageName": "js_std_promise_rejection_check",
"versions": [
{
"version": "2025-04-26",
"lessThan": "2025-09-13",
"versionType": "date",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T18:03:58.190903Z",
"id": "CVE-2025-62491",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2025-09-13",
"matchCriteriaId": "AB84E2DC-74EA-4956-9521-C2B652B8E8C2"
}
]
}
]
}
],
"references": [
{
"url": "https://bellard.org/quickjs/Changelog",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://issuetracker.google.com/434195203",
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
}
]
}