CVE-2025-12745: A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c

Q: How do I fix CVE-2025-12745?

quickjs: upgrade to 2025-11-03. Exact commands for each OS are on this page.

Q: Is CVE-2025-12745 being exploited?

CVE-2025-12745 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-12745 affect?

CVE-2025-12745 affects quickjs. Severity is medium (CVSS 5.3). A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local ex

Q: How urgent is CVE-2025-12745?

Priority 27/100. Public exploit reference

Routine

MEDIUM 5.3UPGRADE

CVE-2025-12745 is a medium-severity flaw (CVSS 5.3) affecting quickjs. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery Patch name: c6fe5a98fd3ef3b7064e6e0145dfebfe1244

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.2% (top 88%)
CISA exploited list	No
Weakness	CWE-119, CWE-126, CWE-125
Published	2025-11-05
Last modified	2026-10-19

Publisher (CNA): VulDB · Vendor: bellard

Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-11-05 19:15 UTCPublished CVE record published
2026-10-19 13:10 UTCUpdated Record last modified

bellard quickjs UPGRADE

Affected: < 2025-11-03

Fixed in: 2025-11-03

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy quickjs || rpm -q quickjs || quickjs --version

2. UPGRADE to 2025-11-03 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade quickjs

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade quickjs

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-12745?

quickjs: upgrade to 2025-11-03. Exact commands for each OS are on this page.

Is CVE-2025-12745 being exploited?

CVE-2025-12745 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-12745 affect?

CVE-2025-12745 affects quickjs. Severity is medium (CVSS 5.3). A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local ex

How urgent is CVE-2025-12745?

Priority 27/100. Public exploit reference

Related CVEs

CVE-2025-62496 HIGH 8.8 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attemp
CVE-2025-62494 HIGH 8.8 UPGRADE A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS
CVE-2025-62495 HIGH 8.8 UPGRADE An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an incons
CVE-2025-62490 HIGH 8.8 UPGRADE In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then l
CVE-2025-62491 HIGH 8.8 UPGRADE A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the g

References

← Back to latest CVEs