CVE-2026-43894

jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g	Exploit Mitigation Vendor Advisory
https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) jq es un procesador JSON de línea de comandos. En la versión 1.8.1 y anteriores, cuando a decNumberFromString se le proporciona un literal numérico de INT_MAX-1 (2147483646) dígitos, la macro D2U() desborda durante la aritmética de enteros con signo. El valor negativo envuelto omite la comprobación del tamaño de la asignación de memoria dinámica (heap), hace que la función utilice un búfer de pila de 30 bytes y luego escribe ?715 millones de unidades de 16 bits (?1.4 GiB) en un desplazamiento de 1.43 GiB por debajo del marco de pila. El contenido escrito está totalmente controlado por el atacante (los dígitos decimales analizados, empaquetados 3 por unidad).

Information

Published : 2026-05-11 18:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-43894

Mitre link : CVE-2026-43894

CVE.ORG link : CVE-2026-43894

JSON object : View

Products Affected

jqlang

jq

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-43894", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43894", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:32:08.384699Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jqlang", "product": "jq", "versions": [{"status": "affected", "version": "<= 1.8.1"}]}]}], "published": "2026-05-11T18:16:37.250", "references": [{"url": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes \u2248715 million 16-bit units (\u22481.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit)."}, {"lang": "es", "value": "jq es un procesador JSON de l\u00ednea de comandos. En la versi\u00f3n 1.8.1 y anteriores, cuando a decNumberFromString se le proporciona un literal num\u00e9rico de INT_MAX-1 (2147483646) d\u00edgitos, la macro D2U() desborda durante la aritm\u00e9tica de enteros con signo. El valor negativo envuelto omite la comprobaci\u00f3n del tama\u00f1o de la asignaci\u00f3n de memoria din\u00e1mica (heap), hace que la funci\u00f3n utilice un b\u00fafer de pila de 30 bytes y luego escribe ?715 millones de unidades de 16 bits (?1.4 GiB) en un desplazamiento de 1.43 GiB por debajo del marco de pila. El contenido escrito est\u00e1 totalmente controlado por el atacante (los d\u00edgitos decimales analizados, empaquetados 3 por unidad)."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2026D0D9-8A88-43D4-9995-CF7928D9FFB8", "versionEndIncluding": "1.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}