CVE-2025-62492 (GCVE-0-2025-62492)
Vulnerability from cvelistv5
Published
2025-10-16 15:51
Modified
2025-10-16 18:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.
* The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.
* If d is negative, the index is calculated relative to the end of the array by adding the array's length (len) to d:
$$d_{new} = d + \text{len}$$
* Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \times 10^{-20}$), the addition $d + \text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\text{len}$.
* The result is then converted to an integer index $k$: $k = \text{len}$.
* The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\text{len}-1$, starting the read at index $\text{len}$ is one element past the end of the array.
This allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62492",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-16T18:01:27.698649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-16T18:02:02.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://bellard.org/quickjs/",
"defaultStatus": "unaffected",
"packageName": "js_typed_array_indexOf",
"product": "QuickJS",
"vendor": "QuickJS",
"versions": [
{
"lessThan": "2025-09-13",
"status": "affected",
"version": "2025-04-26",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Google Big Sleep"
}
],
"datePublic": "2025-07-24T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of \u003ccode\u003eTypedArray.prototype.indexOf()\u003c/code\u003e when a negative \u003cb\u003e\u003ccode\u003efromIndex\u003c/code\u003e\u003c/b\u003e argument is supplied.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe \u003ccode\u003efromIndex\u003c/code\u003e argument (read as a \u003ccode\u003edouble\u003c/code\u003e variable, $d$) is used to calculate the starting position for the search.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eIf d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e$$d_{new} = d + \\text{len}$$\u003c/div\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eDue to the inherent limitations of \u003cb\u003efloating-point arithmetic\u003c/b\u003e, if the negative value $d$ is extremely small (e.g., $-1 \\times 10^{-20}$), the addition $d + \\text{len}$ can result in a loss of precision, yielding an outcome that is \u003cb\u003eexactly equal to $\\text{len}$\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe result is then converted to an integer index $k$: $k = \\text{len}$.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\text{len}-1$, starting the read at index $\\text{len}$ is \u003cb\u003eone element past the end of the array\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003eThis allows an attacker to cause an \u003cb\u003eOut-of-Bounds Read\u003c/b\u003e of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to \u003cb\u003eInformation Disclosure\u003c/b\u003e of adjacent memory contents, depending on the execution environment.\u003cbr\u003e"
}
],
"value": "A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.\n\n * The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.\n\n\n * If d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\n\n\n\n$$d_{new} = d + \\text{len}$$\n\n\n * Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \\times 10^{-20}$), the addition $d + \\text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\\text{len}$.\n\n\n * The result is then converted to an integer index $k$: $k = \\text{len}$.\n\n\n * The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\text{len}-1$, starting the read at index $\\text{len}$ is one element past the end of the array.\n\n\nThis allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment."
}
],
"impacts": [
{
"capecId": "CAPEC-175",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-175 Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-16T15:51:34.445Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"url": "https://bellard.org/quickjs/Changelog"
},
{
"url": "https://issuetracker.google.com/434194797"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Heap out-of-bounds read in js_typed_array_indexOf in QuickJS",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2025-62492",
"datePublished": "2025-10-16T15:51:34.445Z",
"dateReserved": "2025-10-15T08:47:41.878Z",
"dateUpdated": "2025-10-16T18:02:02.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-62492\",\"sourceIdentifier\":\"cve-coordination@google.com\",\"published\":\"2025-10-16T16:15:39.620\",\"lastModified\":\"2025-10-16T16:15:39.620\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.\\n\\n * The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.\\n\\n\\n * If d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\\n\\n\\n\\n$$d_{new} = d + \\\\text{len}$$\\n\\n\\n * Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \\\\times 10^{-20}$), the addition $d + \\\\text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\\\\text{len}$.\\n\\n\\n * The result is then converted to an integer index $k$: $k = \\\\text{len}$.\\n\\n\\n * The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\\\text{len}-1$, starting the read at index $\\\\text{len}$ is one element past the end of the array.\\n\\n\\nThis allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"cve-coordination@google.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://bellard.org/quickjs/Changelog\",\"source\":\"cve-coordination@google.com\"},{\"url\":\"https://issuetracker.google.com/434194797\",\"source\":\"cve-coordination@google.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-62492\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-16T18:01:27.698649Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-16T18:01:37.972Z\"}}], \"cna\": {\"title\": \"Heap out-of-bounds read in js_typed_array_indexOf in QuickJS\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Google Big Sleep\"}], \"impacts\": [{\"capecId\": \"CAPEC-175\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-175 Code Inclusion\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QuickJS\", \"product\": \"QuickJS\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025-04-26\", \"lessThan\": \"2025-09-13\", \"versionType\": \"date\"}], \"packageName\": \"js_typed_array_indexOf\", \"collectionURL\": \"https://bellard.org/quickjs/\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-07-24T22:00:00.000Z\", \"references\": [{\"url\": \"https://bellard.org/quickjs/Changelog\"}, {\"url\": \"https://issuetracker.google.com/434194797\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.\\n\\n * The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.\\n\\n\\n * If d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\\n\\n\\n\\n$$d_{new} = d + \\\\text{len}$$\\n\\n\\n * Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \\\\times 10^{-20}$), the addition $d + \\\\text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\\\\text{len}$.\\n\\n\\n * The result is then converted to an integer index $k$: $k = \\\\text{len}$.\\n\\n\\n * The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\\\text{len}-1$, starting the read at index $\\\\text{len}$ is one element past the end of the array.\\n\\n\\nThis allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of \u003ccode\u003eTypedArray.prototype.indexOf()\u003c/code\u003e when a negative \u003cb\u003e\u003ccode\u003efromIndex\u003c/code\u003e\u003c/b\u003e argument is supplied.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe \u003ccode\u003efromIndex\u003c/code\u003e argument (read as a \u003ccode\u003edouble\u003c/code\u003e variable, $d$) is used to calculate the starting position for the search.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eIf d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e$$d_{new} = d + \\\\text{len}$$\u003c/div\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eDue to the inherent limitations of \u003cb\u003efloating-point arithmetic\u003c/b\u003e, if the negative value $d$ is extremely small (e.g., $-1 \\\\times 10^{-20}$), the addition $d + \\\\text{len}$ can result in a loss of precision, yielding an outcome that is \u003cb\u003eexactly equal to $\\\\text{len}$\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe result is then converted to an integer index $k$: $k = \\\\text{len}$.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\\\text{len}-1$, starting the read at index $\\\\text{len}$ is \u003cb\u003eone element past the end of the array\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003eThis allows an attacker to cause an \u003cb\u003eOut-of-Bounds Read\u003c/b\u003e of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to \u003cb\u003eInformation Disclosure\u003c/b\u003e of adjacent memory contents, depending on the execution environment.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"shortName\": \"Google\", \"dateUpdated\": \"2025-10-16T15:51:34.445Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-62492\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-16T18:02:02.585Z\", \"dateReserved\": \"2025-10-15T08:47:41.878Z\", \"assignerOrgId\": \"14ed7db2-1595-443d-9d34-6215bf890778\", \"datePublished\": \"2025-10-16T15:51:34.445Z\", \"assignerShortName\": \"Google\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…