CVE-2026-41257

Summary

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.

Affected Software

Weaknesses

• CWE-190: CWE-190: Integer Overflow or Wraparound
• CWE-787: CWE-787: Out-of-bounds Write

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539

References

• https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539

• ←Previous
• Next→