CVE-2026-88378: QuickJS Heap Buffer Overflow Vulnerability

CVE-2026-88378 Overview

CVE-2026-88378 is a heap out-of-bounds write vulnerability in QuickJS, a small and embeddable JavaScript engine maintained by Fabrice Bellard. The flaw resides in the JS_ReadFunctionTag() function at commit 04be24600 and is tracked under [CWE-787]. The function fails to validate bounds correctly when deserializing function objects, allowing an attacker to write beyond the allocated heap buffer. Processing attacker-controlled serialized bytecode is sufficient to trigger the condition. Because QuickJS is embedded in applications that evaluate untrusted scripts or deserialized data, exploitation can lead to arbitrary code execution within the host process.

Critical Impact
An attacker can trigger a heap out-of-bounds write by supplying crafted serialized data to JS_ReadFunctionTag(), enabling memory corruption and potential remote code execution in the embedding application.

Affected Products

QuickJS JavaScript engine at commit 04be24600
Downstream projects embedding the affected QuickJS commit
Applications using QuickJS JS_ReadObject() deserialization paths

Discovery Timeline

2026-09-24 - CVE-2026-88378 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-88378

Vulnerability Analysis

QuickJS supports binary serialization of JavaScript objects, including compiled function bytecode, via JS_WriteObject() and JS_ReadObject(). The deserialization routine JS_ReadFunctionTag() reconstructs a JSFunctionBytecode structure from a serialized byte stream.

The out-of-bounds write occurs when JS_ReadFunctionTag() processes attacker-controlled length and offset fields without sufficient validation. Fields such as the bytecode length, closure variable count, or local variable count can be set to values that exceed the actual size of the allocated destination buffer. The parser then writes past the heap allocation boundary, corrupting adjacent heap metadata or object data.

Memory corruption of this nature typically enables control-flow hijacking when combined with heap layout grooming. Public references point to GitHub Issue #549 and the fix in GitHub Pull Request #553.

Root Cause

The root cause is missing or insufficient bounds checking in the deserialization logic of JS_ReadFunctionTag(). Length fields read from the untrusted input stream are used to drive memory writes without being validated against the actual allocation size or against sane upper limits.

Attack Vector

An attacker crafts a malicious serialized QuickJS object and delivers it to an application that calls JS_ReadObject() on untrusted input. The attack requires no authentication and no user interaction when the application accepts remote serialized payloads. Common attack surfaces include network services, IPC endpoints, and applications that persist and reload QuickJS bytecode from attacker-reachable storage.

No verified proof-of-concept code is available. The patch in Pull Request #553 changes illustrates the corrected validation logic.

Detection Methods for CVE-2026-88378

Indicators of Compromise

Process crashes or heap corruption aborts in applications linking QuickJS during deserialization of external data
Unexpected child processes or outbound network connections spawned by QuickJS-embedding binaries
AddressSanitizer or glibc heap-check messages referencing JS_ReadFunctionTag or JS_ReadObject call stacks

Detection Strategies

Inventory software that embeds QuickJS and compare build commits against the vulnerable 04be24600 baseline
Enable runtime hardening such as AddressSanitizer in test environments to catch out-of-bounds writes during fuzzing
Monitor endpoint telemetry for anomalous behavior originating from processes known to parse serialized QuickJS objects

Monitoring Recommendations

Collect and alert on segmentation faults and abort signals from QuickJS-based applications
Log all external inputs feeding JS_ReadObject() to establish a baseline for anomaly detection
Correlate process-crash events with subsequent suspicious activity on the same host

How to Mitigate CVE-2026-88378

Immediate Actions Required

Identify every application and container image that embeds QuickJS at or near commit 04be24600
Rebuild and redeploy affected binaries with the fix from Pull Request #553 applied
Restrict exposure of code paths that pass untrusted input to JS_ReadObject() until patched builds are deployed

Patch Information

The upstream fix is available in QuickJS Pull Request #553. Downstream maintainers should cherry-pick the commit referenced in the pull request changes view and rebuild all dependent artifacts. Verify the patched version by running the QuickJS test suite and any custom fuzzing harnesses.

Workarounds

Reject or sandbox all serialized QuickJS objects originating from untrusted sources
Isolate QuickJS evaluation in a low-privilege process with seccomp or equivalent syscall filtering
Disable the JS_ReadObject() code path in builds that do not require bytecode deserialization

bash

# Rebuild QuickJS from a patched source tree
git clone https://github.com/bellard/quickjs.git
cd quickjs
git fetch origin pull/553/head:fix-553
git checkout fix-553
make clean && make