# CVE-2026-49839: jqlang jq heap out-of-bounds write in --rawfile processing

Source: https://junglewise.ai/threats/cve-2026-49839-jqlang-jq-heap-out-of-bounds-write-in-rawfile-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-49839 · Severity: high · CVSS 7.1 · Published 2026-06-25

jq is a popular command-line tool used for processing and transforming JSON data in automation, data pipelines, and web backends. A vulnerability exists where processing a specially crafted, extremely large file can cause the tool to crash or corrupt its memory. This could allow an attacker to disrupt automated services or potentially gain further unauthorized access to the system running the tool.

Technologies: [Jqlang Jq](https://junglewise.ai/threats/technologies/jq). Vendors: [Jqlang](https://junglewise.ai/threats/vendors/jqlang).

## Quick answers

**Is CVE-2026-49839 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49839 being exploited in the wild.

**How severe is CVE-2026-49839?** High severity, with a CVSS score of 7.1, published 25 June 2026.

**Which products and versions are affected?** Jqlang Jq < 1.8.2.

**Is there a fix for CVE-2026-49839?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49839 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-49839?** Check whether you run Jqlang Jq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in jq's jv_load_file function when using the --rawfile flag. When reading a file larger than approximately 2GB, the jv_string_append_buf function correctly identifies that the string is too long and returns an invalid object state. However, the raw-file loop fails to terminate upon this error, causing subsequent iterations to attempt to append data to the now-invalid object. In builds where assertions are disabled (common in production), this invalid object is misinterpreted as a valid string pointer, leading to an out-of-bounds write. An attacker providing a malicious file can trigger a denial of service or potentially achieve code execution depending on the environment. The issue is fixed in version 1.8.2.

## Affected products

- jqlang jq < 1.8.2

## Timeline

- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date

## References

- [https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm](https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm)

## Related threats

- [jqlang jq integer overflow in jvp_string_append on 32-bit systems](https://junglewise.ai/threats/cve-2026-54679-jqlang-jq-integer-overflow-in-jvp-string-append-on-32-bit-systems)
- [jqlang jq Denial of Service via Stack Exhaustion in Structural Comparison](https://junglewise.ai/threats/cve-2026-47770-jqlang-jq-denial-of-service-via-stack-exhaustion-in-structural)
- [jqlang jq uncontrolled recursion in module loader](https://junglewise.ai/threats/cve-2026-44777-jqlang-jq-uncontrolled-recursion-in-module-loader)
- [jqlang jq stack overflow in jv_object_merge_recursive](https://junglewise.ai/threats/cve-2026-43896-jqlang-jq-stack-overflow-in-jv-object-merge-recursive)
- [jqlang jq path resolution mismatch via embedded NUL bytes in linker](https://junglewise.ai/threats/cve-2026-43895-jqlang-jq-path-resolution-mismatch-via-embedded-nul-bytes-in)