# CVE-2026-54679: jqlang jq integer overflow in jvp_string_append on 32-bit systems

Source: https://junglewise.ai/threats/cve-2026-54679-jqlang-jq-integer-overflow-in-jvp-string-append-on-32-bit-systems  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54679 · Severity: info · CVSS 6.9 · Published 2026-06-25

jq is a widely used command-line tool for processing and transforming JSON data. A vulnerability in certain versions running on 32-bit systems could allow a specially crafted JSON input to crash the application or potentially allow unauthorized code execution. This occurs because the tool incorrectly calculates memory requirements when joining large strings, leading to a memory corruption event.

Technologies: [Jqlang Jq](https://junglewise.ai/threats/technologies/jq). Vendors: [Jqlang](https://junglewise.ai/threats/vendors/jqlang).

## Quick answers

**Is CVE-2026-54679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54679 being exploited in the wild.

**How severe is CVE-2026-54679?** Informational severity, with a CVSS score of 6.9, published 25 June 2026.

**Which products and versions are affected?** Jqlang Jq < 1.8.2.

**Is there a fix for CVE-2026-54679?** A patch was published on 2026-06-25: Fix released in version 1.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54679 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54679?** Check whether you run Jqlang Jq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the `jvp_string_append` function in `src/jv.c` of jq when running on 32-bit architectures. The software attempts to prevent overflows by checking if the combined length of strings exceeds `INT_MAX`, but subsequently doubles the allocation size using 32-bit arithmetic. On 32-bit systems, the calculation `(currlen + len) * 2` can result in a value that, when passed to `jvp_string_alloc`, causes `sizeof(jvp_string) + size + 1` to wrap around `size_t`. This leads to a very small memory allocation followed by a large `memcpy` operation, resulting in a heap-based buffer overflow. An attacker providing malicious JSON input could trigger this overflow to cause a denial of service or potentially execute arbitrary code. The issue is resolved in version 1.8.2.

## Affected products

- jqlang jq < 1.8.2

## Timeline

- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD
- 2026-06-25: patched: Fix released in version 1.8.2

## References

- [https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx](https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx)

## Related threats

- [jqlang jq heap out-of-bounds write in --rawfile processing](https://junglewise.ai/threats/cve-2026-49839-jqlang-jq-heap-out-of-bounds-write-in-rawfile-processing)
- [jqlang jq Denial of Service via Stack Exhaustion in Structural Comparison](https://junglewise.ai/threats/cve-2026-47770-jqlang-jq-denial-of-service-via-stack-exhaustion-in-structural)
- [jqlang jq uncontrolled recursion in module loader](https://junglewise.ai/threats/cve-2026-44777-jqlang-jq-uncontrolled-recursion-in-module-loader)
- [jqlang jq stack overflow in jv_object_merge_recursive](https://junglewise.ai/threats/cve-2026-43896-jqlang-jq-stack-overflow-in-jv-object-merge-recursive)
- [jqlang jq path resolution mismatch via embedded NUL bytes in linker](https://junglewise.ai/threats/cve-2026-43895-jqlang-jq-path-resolution-mismatch-via-embedded-nul-bytes-in)