PT-2026-32546 · Jq+3 · Jq+3
Ho-9
·
Published
2026-04-13
·
Updated
2026-05-24
·
CVE-2026-39979
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
jq versions prior to 2f09060afab23fe9390cce7cb860b10416e1bf5f
Description
The
jv parse sized() API in libjq accepts a counted buffer with an explicit length parameter. However, its error-handling path formats the input buffer using %s in jv string fmt(), which reads until a NUL terminator is found instead of respecting the provided length. When malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. This can lead to memory disclosure or process termination depending on the memory layout.Recommendations
Update to version 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Rocky Linux
Ubuntu
Jq