PT-2026-32542 · Jq+2 · Jq+2

Tlsbollei · Published 2026-04-08 · Updated 2026-05-24 · CVE-2026-39956

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions jq (affected versions not specified)

Description The strindices builtin in src/builtin.c passes arguments to jv string indexes() in src/jv.c without verifying they are strings. Because jv string indexes() relies on assert() checks that are removed in release builds compiled with -DNDEBUG, an attacker can cause a crash by providing input such as strindices(0). Additionally, by crafting a numeric value with an IEEE-754 bit pattern that maps to a specific pointer, a controlled pointer dereference and limited memory read/probe primitive can be achieved. This affects deployments that evaluate untrusted filters against a release build.

Recommendations Apply the fix provided in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.

Exploit

Fix

Out of bounds Read

Type Confusion

NULL Pointer Dereference

Weakness Enumeration

CWE-125

CWE-843

CWE-476

Related Identifiers

BDU:2026-05499

CVE-2026-39956

ECHO-70DE-E2DC-F745

OESA-2026-1981

OPENSUSE-SU-2026:10850-1

RHSA-2026:8579

USN-8202-1

USN-8202-2

Affected Products

Linuxmint

Ubuntu

Jq

References · 41

• 🔥 https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28 · Exploit
• https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40164 · Security Note
• https://ubuntu.com/security/CVE-2026-33948 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8202-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32316 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33947 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10850-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39956 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8202-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33948 · Security Note
• https://ubuntu.com/security/notices/USN-8202-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39956 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05499 · Security Note