CVE-2025-62496

CVE-2025-62496 is a high-severity heap out-of-bounds write vulnerability affecting the QuickJS engine, specifically in its BigInt string parsing logic. When processing excessively long BigInt strings, an integer overflow occurs during the calculation of memory allocation, leading to an undersized buffer. This allows an attacker to write data beyond the allocated memory, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS score of 8.8 (HIGH) with a low attack complexity and no required user interaction, indicating a significant risk. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.