{"id":"CVE-2025-62490","details":"In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms-\u003erecords list, but once again, elements could be removed from the list during js_print_value call.","modified":"2026-04-10T05:33:07.318216Z","published":"2025-10-16T16:15:39.270Z","references":[{"type":"ADVISORY","url":"https://bellard.org/quickjs/Changelog"},{"type":"REPORT","url":"https://issuetracker.google.com/434196651"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"2025-09-13"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62490.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}