mquickjs Denial-of-Service Vulnerability in get_mblock_size Function

A denial-of-service vulnerability has been identified in mquickjs versions prior to the January 15, 2026 commit 74b7e. This issue allows a local attacker to cause a segmentation fault by sending a crafted file to the get_mblock_size function in mquickjs.c.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a crash of the mquickjs program.

Reproduction

The vulnerability can be reproduced by compiling mquickjs with the x86_32 architecture flag, then running the program with a file that contains an empty string followed by a parenthetical expression, such as '(123)'. This combination triggers the segmentation fault by causing a read memory access violation.

Remediation

Users can update to the latest version of mquickjs, as this vulnerability has been fixed in the January 15, 2026 commit.