{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62492",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T18:01:27.698649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T18:02:02.585Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://bellard.org/quickjs/",
          "defaultStatus": "unaffected",
          "packageName": "js_typed_array_indexOf",
          "product": "QuickJS",
          "vendor": "QuickJS",
          "versions": [
            {
              "lessThan": "2025-09-13",
              "status": "affected",
              "version": "2025-04-26",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-07-24T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of \u003ccode\u003eTypedArray.prototype.indexOf()\u003c/code\u003e when a negative \u003cb\u003e\u003ccode\u003efromIndex\u003c/code\u003e\u003c/b\u003e argument is supplied.\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe \u003ccode\u003efromIndex\u003c/code\u003e argument (read as a \u003ccode\u003edouble\u003c/code\u003e variable, $d$) is used to calculate the starting position for the search.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eIf d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e$$d_{new} = d + \\text{len}$$\u003c/div\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eDue to the inherent limitations of \u003cb\u003efloating-point arithmetic\u003c/b\u003e, if the negative value $d$ is extremely small (e.g., $-1 \\times 10^{-20}$), the addition $d + \\text{len}$ can result in a loss of precision, yielding an outcome that is \u003cb\u003eexactly equal to $\\text{len}$\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe result is then converted to an integer index $k$: $k = \\text{len}$.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\text{len}-1$, starting the read at index $\\text{len}$ is \u003cb\u003eone element past the end of the array\u003c/b\u003e.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003eThis allows an attacker to cause an \u003cb\u003eOut-of-Bounds Read\u003c/b\u003e of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to \u003cb\u003eInformation Disclosure\u003c/b\u003e of adjacent memory contents, depending on the execution environment.\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine\u0027s implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.\n\n  *  The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.\n\n\n  *  If d is negative, the index is calculated relative to the end of the array by adding the array\u0027s length (len) to d:\n\n\n\n$$d_{new} = d + \\text{len}$$\n\n\n  *  Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \\times 10^{-20}$), the addition $d + \\text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\\text{len}$.\n\n\n  *  The result is then converted to an integer index $k$: $k = \\text{len}$.\n\n\n  *  The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\\text{len}-1$, starting the read at index $\\text{len}$ is one element past the end of the array.\n\n\nThis allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T15:51:34.445Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://bellard.org/quickjs/Changelog"
        },
        {
          "url": "https://issuetracker.google.com/434194797"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap out-of-bounds read in js_typed_array_indexOf in QuickJS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-62492",
    "datePublished": "2025-10-16T15:51:34.445Z",
    "dateReserved": "2025-10-15T08:47:41.878Z",
    "dateUpdated": "2025-10-16T18:02:02.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}