CVE-2025-70347: mquickjs Denial of Service Vulnerability

CVE-2025-70347 Overview

A denial of service vulnerability exists in mquickjs, a lightweight JavaScript engine, prior to commit 74b7e (2026-01-15). The vulnerability resides in the get_mblock_size function within mquickjs.c, allowing a local attacker to cause a denial of service condition by supplying a specially crafted file to the vulnerable function.

Critical Impact

Local attackers can exploit this vulnerability to cause application crashes and denial of service, potentially disrupting services that rely on mquickjs for JavaScript execution.

Affected Products

• mquickjs (versions before commit 74b7e dated 2026-01-15)

Discovery Timeline

• 2026-02-10 - CVE CVE-2025-70347 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2025-70347

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), indicating that the get_mblock_size function in mquickjs fails to properly handle malformed or malicious input files. When an attacker provides a specially crafted file to this function, it can trigger resource exhaustion or improper memory handling, leading to a denial of service condition.

The attack requires local access and user interaction (such as opening or processing the crafted file), but once triggered, it can cause complete unavailability of the affected application. The vulnerability impacts only availability—no confidentiality or integrity compromise has been identified.

Root Cause

The root cause lies in improper input validation within the get_mblock_size function in mquickjs.c. The function does not adequately verify the structure or content of input files before processing, allowing malformed data to trigger uncontrolled resource consumption or crash the application.

Attack Vector

The attack vector is local, requiring the attacker to have access to the target system and convince a user or process to load the crafted malicious file. The exploitation path involves:

1. Attacker creates a specially crafted file designed to exploit the get_mblock_size function
2. The malicious file is delivered to the target system through social engineering or other local access methods
3. When the mquickjs engine processes the crafted file, it triggers the vulnerability
4. The application crashes or becomes unresponsive, causing denial of service

For technical details on the vulnerability mechanism, refer to the GitHub Issue Discussion where the issue was reported and discussed.

Detection Methods for CVE-2025-70347

Indicators of Compromise

• Unexpected crashes or termination of applications using mquickjs
• Presence of unusual or malformed JavaScript files in system directories
• Application logs showing errors related to get_mblock_size function failures

Detection Strategies

• Monitor mquickjs-based applications for unexpected process terminations
• Implement file integrity monitoring for input files processed by mquickjs
• Review application crash dumps for stack traces involving get_mblock_size or related functions

Monitoring Recommendations

• Enable verbose logging for mquickjs-based applications to capture error conditions
• Set up alerting for repeated application crashes or restarts
• Monitor system resource utilization for signs of resource exhaustion attacks

How to Mitigate CVE-2025-70347

Immediate Actions Required

• Update mquickjs to commit 74b7e (2026-01-15) or later
• Restrict local access to systems running mquickjs-based applications
• Implement input validation for files processed by mquickjs before execution

Patch Information

The vulnerability has been addressed in mquickjs commit 74b7e dated 2026-01-15. Organizations using mquickjs should update to this commit or any subsequent version that includes the fix. For details on the fix, refer to the GitHub Issue Discussion.

Workarounds

• Validate and sanitize all input files before processing with mquickjs
• Implement process isolation or sandboxing for mquickjs execution environments
• Restrict file access permissions to limit exposure to potentially malicious files
• Deploy application-level monitoring to detect and recover from denial of service conditions