{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62493",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T17:56:52.934146Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T17:59:10.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://bellard.org/quickjs/",
          "defaultStatus": "unaffected",
          "packageName": "js_bigint_to_string1",
          "product": "QuickJS",
          "vendor": "QuickJS",
          "versions": [
            {
              "lessThan": "2025-09-13",
              "status": "affected",
              "version": "2025-04-26",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-07-24T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability exists in the QuickJS engine\u0027s BigInt string conversion logic (\u003ccode\u003ejs_bigint_to_string1\u003c/code\u003e) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe function determines the number of characters (\u003ccode\u003en_digits\u003c/code\u003e) needed for the string representation by calculating:\u003c/p\u003e\u003cdiv\u003e$$ \\\\ \\text{n\\_digits} = (\\text{n\\_bits} + \\text{log2\\_radix} - 1) / \\text{log2\\_radix}$$\u003c/div\u003e\u003cp\u003e$$$$This formula is \u003cb\u003eoff-by-one\u003c/b\u003e in certain edge cases when calculating the necessary memory limbs. For instance, a 127-bit BigInt using radix 32 (where $\\text{log2\\_radix}=5$) is calculated to need $\\text{n\\_digits}=26$.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe maximum number of bits actually stored is $\\text{n\\_bits}=127$, which requires only two 64-bit limbs ($\\text{JS\\_LIMB\\_BITS}=64$).\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe conversion loop iterates \u003cb\u003e$\\text{n\\_digits}=26$ times\u003c/b\u003e, attempting to read 5 bits in each iteration, totaling $26 \\times 5 = 130$ bits.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eIn the final iterations of the loop, the code attempts to read data that spans two limbs:\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003eC\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cpre\u003e\u003ccode\u003ec = (r-\u0026gt;tab[pos] \u0026gt;\u0026gt; shift) | (r-\u0026gt;tab[pos + 1] \u0026lt;\u0026lt; (JS_LIMB_BITS - shift));\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eSince the BigInt was only allocated two limbs, the read operation for \u003ccode\u003er-\u0026gt;tab[pos + 1]\u003c/code\u003e becomes an \u003cb\u003eOut-of-Bounds Read\u003c/b\u003e when \u003ccode\u003epos\u003c/code\u003e points to the last valid limb (e.g., $pos=1$).\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eThis vulnerability allows an attacker to cause the engine to read and process data from the memory immediately following the BigInt buffer. This can lead to \u003cb\u003eInformation Disclosure\u003c/b\u003e of sensitive data stored on the heap adjacent to the BigInt object.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability exists in the QuickJS engine\u0027s BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure.\n\n  *  The function determines the number of characters (n_digits) needed for the string representation by calculating:\n\n$$ \\\\ \\text{n\\_digits} = (\\text{n\\_bits} + \\text{log2\\_radix} - 1) / \\text{log2\\_radix}$$\n\n$$$$This formula is off-by-one in certain edge cases when calculating the necessary memory limbs. For instance, a 127-bit BigInt using radix 32 (where $\\text{log2\\_radix}=5$) is calculated to need $\\text{n\\_digits}=26$.\n\n\n  *  The maximum number of bits actually stored is $\\text{n\\_bits}=127$, which requires only two 64-bit limbs ($\\text{JS\\_LIMB\\_BITS}=64$).\n\n\n  *  The conversion loop iterates $\\text{n\\_digits}=26$ times, attempting to read 5 bits in each iteration, totaling $26 \\times 5 = 130$ bits.\n\n\n  *  In the final iterations of the loop, the code attempts to read data that spans two limbs:\n\nC\n\n\n\nc = (r-\u003etab[pos] \u003e\u003e shift) | (r-\u003etab[pos + 1] \u003c\u003c (JS_LIMB_BITS - shift));\n\n\n\n\n\n\n\n\n\n  *  Since the BigInt was only allocated two limbs, the read operation for r-\u003etab[pos + 1] becomes an Out-of-Bounds Read when pos points to the last valid limb (e.g., $pos=1$).\n\n\nThis vulnerability allows an attacker to cause the engine to read and process data from the memory immediately following the BigInt buffer. This can lead to Information Disclosure of sensitive data stored on the heap adjacent to the BigInt object."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T15:51:42.952Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://bellard.org/quickjs/Changelog"
        },
        {
          "url": "https://issuetracker.google.com/434193024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap out-of-bounds read in js_bigint_to_string1 in QuickJS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-62493",
    "datePublished": "2025-10-16T15:51:42.952Z",
    "dateReserved": "2025-10-15T08:47:41.878Z",
    "dateUpdated": "2025-10-16T17:59:10.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}