What is CVE-2026-120438 and how does it occur?
CVE-2026-120438 is a high-severity security vulnerability with a CVSS score of 7.8 affecting QuickJS-NG before version 0.16.0 Rust zip library vulnerability. The issue stems from an integer overflow located in the js_proxy_get_own_property_names() function within quickjs.c on 32-bit host architectures.
This flaw can lead directly to a heap buffer overflow condition when handling property enumerations. While analyzing similar low-level memory issues local privilege escalation flaws, security researchers found that memory management discrepancies in restricted environments often lead to serious stability risks.
Who is affected and how can the vulnerability be exploited?
Attackers capable of executing JavaScript code can exploit this vulnerability by returning a maliciously crafted, extremely large array-like object from a Proxy ownKeys trap.
This crafted return value wraps the internal memory allocation size calculation, triggering a heap buffer overflow. Depending on the environment, this behavior can result in sudden application crashes or potentially allow arbitrary code execution, similar to other critical issues such as ActivityStarter local privilege escalation.
How can I protect my systems and mitigate this risk?
Mitigating this integer overflow requires immediate action from developers and administrators managing 32-bit host environments. You should apply the official patch or upgrade the codebase immediately.
Follow these steps to secure your environment against CVE-2026-120438:
- Review your current project dependencies and verify if QuickJS-NG is used in any 32-bit execution contexts.
- Access the official security advisory page at to review the exact source code modifications.
- Upgrade your QuickJS-NG dependency to version 0.16.0 or merge the official commit 252209d99cf112568160548bdcaa98d95e0d0068 into your codebase.
- Recompile your binaries and run your test suites to ensure proper memory allocation behavior.