{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T18:03:58.190903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T18:04:16.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://bellard.org/quickjs/",
          "defaultStatus": "unaffected",
          "packageName": "js_std_promise_rejection_check",
          "product": "QuickJS",
          "vendor": "QuickJS",
          "versions": [
            {
              "lessThan": "2025-09-13",
              "status": "affected",
              "version": "2025-04-26",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        }
      ],
      "datePublic": "2025-07-24T22:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA \u003cb\u003eUse-After-Free (UAF)\u003c/b\u003e vulnerability exists in the QuickJS engine\u0027s standard library when iterating over the global list of unhandled rejected promises (\u003ccode\u003ets-\u0026gt;rejected_promise_list\u003c/code\u003e).\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eThe function \u003cb\u003e\u003ccode\u003ejs_std_promise_rejection_check\u003c/code\u003e\u003c/b\u003e attempts to iterate over the \u003ccode\u003erejected_promise_list\u003c/code\u003e to report unhandled rejections using a standard list loop.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe \u003cb\u003ereason\u003c/b\u003e for a promise rejection is processed inside the loop, including calling \u003ccode\u003ejs_std_dump_error1(ctx, rp-\u0026gt;reason)\u003c/code\u003e.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eIf the promise \u003cb\u003erejection reason\u003c/b\u003e is an \u003cb\u003eError object\u003c/b\u003e that defines a custom property \u003cb\u003egetter\u003c/b\u003e (e.g., via \u003ccode\u003eObject.defineProperty\u003c/code\u003e), this getter is executed during the error dumping process.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe malicious custom getter can execute JavaScript code that calls \u003cb\u003e\u003ccode\u003ecatch()\u003c/code\u003e\u003c/b\u003e on the \u003ci\u003esame\u003c/i\u003e rejected promise being processed.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eCalling \u003ccode\u003ecatch()\u003c/code\u003e internally triggers \u003cb\u003e\u003ccode\u003ejs_std_promise_rejection_tracker\u003c/code\u003e\u003c/b\u003e, which then \u003cb\u003eremoves and frees\u003c/b\u003e the current promise entry (\u003ccode\u003eJSRejectedPromiseEntry\u003c/code\u003e) from the \u003ccode\u003erejected_promise_list\u003c/code\u003e.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eSince the list iteration continues using the now-freed memory pointer (\u003ccode\u003eel\u003c/code\u003e), the subsequent loop access results in a \u003cb\u003eUse-After-Free\u003c/b\u003e condition.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Use-After-Free (UAF) vulnerability exists in the QuickJS engine\u0027s standard library when iterating over the global list of unhandled rejected promises (ts-\u003erejected_promise_list).\n\n  *  The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop.\n\n\n  *  The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp-\u003ereason).\n\n\n  *  If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process.\n\n\n  *  The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed.\n\n\n  *  Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list.\n\n\n  *  Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-175",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-175 Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T15:51:24.238Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "url": "https://bellard.org/quickjs/Changelog"
        },
        {
          "url": "https://issuetracker.google.com/434195203"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Use-after-free in js_std_promise_rejection_check in QuickJS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2025-62491",
    "datePublished": "2025-10-16T15:51:24.238Z",
    "dateReserved": "2025-10-15T08:47:41.878Z",
    "dateUpdated": "2025-10-16T18:04:16.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}