CVE-2025-62495
Full vulnerability record from the local CVENow database.
Description
An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typically 32-bit). * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow). * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative offset is then incorrectly added to the buffer pointer (s->byte\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s->byte_code.buf + pos, len);
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-16 16:15:40.110000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-62495",
"sourceIdentifier": "[email protected]",
"published": "2025-10-16T16:15:40.110",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.\n\n * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\\text{size}\\_\\text{t}$ (an unsigned type, typically 64-bit) for its size member.\n\n\n * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\\text{size}\\_\\text{t}$ value into a signed int (typically 32-bit).\n\n\n * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).\n\n\n * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.\n\n\n * This negative offset is then incorrectly added to the buffer pointer (s->byte\\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:\n\nput_u32(s->byte_code.buf + pos, len);"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de desbordamiento de entero en el motor de expresiones regulares QuickJS (libregexp) debido a una representación inconsistente del tamaño del búfer de bytecode.\n\n * El bytecode de la expresión regular se almacena en una estructura DynBuf, que utiliza correctamente un $\\text{size}\\_\\text{t}$ (un tipo sin signo, típicamente de 64 bits) para su miembro de tamaño.\n\n\n * Sin embargo, varias funciones, como re_emit_op_u32 y otras rutinas de análisis internas, convierten o almacenan incorrectamente este valor $\\text{size}\\_\\text{t}$ de DynBuf en un int con signo (típicamente de 32 bits).\n\n\n * Cuando una expresión regular grande o compleja (como las generadas por un patrón recursivo en una Prueba de Concepto) hace que el tamaño del bytecode exceda los $2^{31}$ bytes (el valor positivo máximo para un entero con signo de 32 bits), el valor del tamaño se ajusta, resultando en un entero negativo cuando se almacena en la variable int (Desbordamiento de Entero).\n\n\n * Este valor negativo se utiliza posteriormente en cálculos de desplazamiento. Por ejemplo, dentro de funciones como re_parse_disjunction, el tamaño negativo se utiliza para calcular un desplazamiento (pos) para parchear una instrucción de salto.\n\n\n * Este desplazamiento negativo se añade incorrectamente al puntero del búfer (s -> byte\\_code.buf + pos), lo que lleva a una escritura fuera de límites en la primera línea del fragmento siguiente:\n\nput_u32(s -> byte_code.buf + pos, len);"
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "QuickJS",
"product": "QuickJS",
"defaultStatus": "unaffected",
"collectionURL": "https://bellard.org/quickjs/",
"packageName": "libregexp",
"versions": [
{
"version": "2025-04-26",
"lessThan": "2025-09-13",
"versionType": "date",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T17:40:14.439633Z",
"id": "CVE-2025-62495",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2025-09-13",
"matchCriteriaId": "AB84E2DC-74EA-4956-9521-C2B652B8E8C2"
}
]
}
]
}
],
"references": [
{
"url": "https://bellard.org/quickjs/Changelog",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://issuetracker.google.com/434196926",
"source": "[email protected]",
"tags": [
"Exploit",
"Issue Tracking"
]
}
]
}