PatchTheCVEbellard vulnerabilities
Recent CVEs affecting bellard products. 2 tracked.
bellard has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-11-05. Highest priority: CVE-2025-46687 (score 30/100).
- CVE-2025-12745 MEDIUM 5.3 UPGRADE A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c
- CVE-2025-46687 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buf
FAQ
How do I fix bellard vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bellard being exploited right now?
None of the tracked bellard CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bellard CVE should I patch first?
CVE-2025-46687 currently ranks highest (30/100): quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buf.