CVE-2026-41257

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539	Exploit Mitigation Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) jq es un procesador JSON de línea de comandos. En 1.8.1 y versiones anteriores, la pila de datos de la VM de bytecode de jq rastrea su tamaño de asignación en un entero con signo. Cuando la pila crece más allá de ?1 GiB (a través de bifurcaciones de generador profundamente anidadas), la aritmética de duplicación desborda. El valor envuelto se pasa a realloc y luego se usa para un memmove con desplazamientos influenciados por el atacante.

Information

Published : 2026-05-11 18:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-41257

Mitre link : CVE-2026-41257

CVE.ORG link : CVE-2026-41257

JSON object : View

Products Affected

jqlang

jq

CWE

CWE-190

Integer Overflow or Wraparound

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-41257", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41257", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-11T19:25:55.560785Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jqlang", "product": "jq", "versions": [{"status": "affected", "version": "<= 1.8.1"}]}]}], "published": "2026-05-11T18:16:34.127", "references": [{"url": "https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond \u22481 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets."}, {"lang": "es", "value": "jq es un procesador JSON de l\u00ednea de comandos. En 1.8.1 y versiones anteriores, la pila de datos de la VM de bytecode de jq rastrea su tama\u00f1o de asignaci\u00f3n en un entero con signo. Cuando la pila crece m\u00e1s all\u00e1 de ?1 GiB (a trav\u00e9s de bifurcaciones de generador profundamente anidadas), la aritm\u00e9tica de duplicaci\u00f3n desborda. El valor envuelto se pasa a realloc y luego se usa para un memmove con desplazamientos influenciados por el atacante."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2026D0D9-8A88-43D4-9995-CF7928D9FFB8", "versionEndIncluding": "1.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}