CVE-2026-43894
MEDIUM EPSS 5.4%
Published May 11, 20261mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published May 11, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
5.4% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-190 Integer Overflow or Wraparound Numeric Error
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| jqlang | jq | * | ≤1.8.1 |
References 1
- github.com https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.