# CVE-2026-120439: QuickJS-NG integer overflow in TypedArray sort

Source: https://junglewise.ai/threats/cve-2026-120439-quickjs-ng-before-0-16-0-contains-an-integer-overflow-in-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120439 · Severity: high · CVSS 7 · Published 2026-11-02

QuickJS-NG is a JavaScript engine used in embedded and application scripting contexts. An integer overflow in the TypedArray sort function allows attackers running JavaScript code to trigger a heap buffer overflow on 32-bit systems. This could lead to application crashes or, in the worst case, arbitrary code execution.

Technologies: [QuickJS-NG](https://junglewise.ai/threats/technologies/quickjs-ng). Vendors: [QuickJS-NG](https://junglewise.ai/threats/vendors/quickjs-ng).

## Quick answers

**Is CVE-2026-120439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120439 being exploited in the wild.

**How severe is CVE-2026-120439?** High severity, with a CVSS score of 7, published 2 November 2026.

**Which products and versions are affected?** QuickJS-NG before 0.16.0.

**Is there a fix for CVE-2026-120439?** Yes: fixed in 0.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120439 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120439?** Check whether you run QuickJS-NG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.16.0

## Technical details

An integer overflow in the js_typed_array_sort() function in quickjs.c fails to properly validate the allocation size when sorting typed arrays. An attacker can call TypedArray.prototype.sort with a comparator on an array near 2^30 elements, causing the size calculation to wrap and allocating a smaller buffer than required. This results in writing array indices past the allocated buffer boundary, corrupting the heap.

## Affected products

- QuickJS-NG QuickJS-NG before 0.16.0

## Timeline

- 2026-11-02: disclosed

## References

- [https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c](https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c)
- [https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568](https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568)

## Related threats

- [QuickJS-NG memory leak in Atomics.store()](https://junglewise.ai/threats/cve-2026-120440-quickjs-ng-before-0-16-0-contains-a-memory-leak-vulnerability-in)
- [QuickJS-NG integer overflow in Proxy ownKeys enumeration](https://junglewise.ai/threats/cve-2026-120438-quickjs-ng-before-0-16-0-contains-an-integer-overflow-in-js)
- [QuickJS-NG arbitrary code execution in js_mapped_arguments_mark](https://junglewise.ai/threats/cve-2026-37630-quickjs-ng-arbitrary-code-execution-in-js-mapped-arguments-mark)