Executive brief
jq is a widely used command-line tool for processing and transforming JSON data. A vulnerability in its internal memory management allows a specially crafted JSON query to cause the program to crash or potentially corrupt system memory. This could lead to a denial-of-service or, in more complex scenarios, allow an attacker to execute unauthorized code if they can convince a user to run a malicious script.
Technical details
An integer overflow vulnerability exists in the jq bytecode VM's data stack management within `src/exec_stack.h`. The stack uses a signed integer (`stack_ptr`) to track allocation sizes. When the stack grows beyond approximately 1 GiB via deeply nested generator forks, the doubling arithmetic in `stack_reallocate` overflows. This results in a truncated or wrapped value being passed to `realloc` and subsequently used in a `memmove` operation with attacker-influenced offsets. While often resulting in a Denial of Service (abort due to failed allocation), specific recursion depths could lead to an out-of-bounds heap write. No patch was available at the time of the advisory.
Affected products
- jqlang jq <= 1.8.1
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE-2026-41257 published to NVD