Quick answers
- Is CVE-2026-49839 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49839 being exploited in the wild.
- How severe is CVE-2026-49839?
- High severity, with a CVSS score of 7.1, published 25 June 2026.
- Which products and versions are affected?
- Jqlang Jq < 1.8.2.
- Is there a fix for CVE-2026-49839?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49839 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-49839?
- Check whether you run Jqlang Jq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in jq's jv_load_file function when using the --rawfile flag. When reading a file larger than approximately 2GB, the jv_string_append_buf function correctly identifies that the string is too long and returns an invalid object state. However, the raw-file loop fails to terminate upon this error, causing subsequent iterations to attempt to append data to the now-invalid object. In builds where assertions are disabled (common in production), this invalid object is misinterpreted as a valid string pointer, leading to an out-of-bounds write. An attacker providing a malicious file can trigger a denial of service or potentially achieve code execution depending on the environment. The issue is fixed in version 1.8.2.
Affected products
- jqlang jq < 1.8.2
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date