Out-of-Bounds Write in jq Product by JQLang

CVE-2023-49355

What is CVE-2023-49355?

The vulnerability arises from a one-byte out-of-bounds write flaw in the decToString function within the jq implementation. This issue can be triggered by sending a specially crafted input, such as '[]-1.2e-1111111111', which results in unintended memory access. This defect poses a risk for applications relying on jq as it can potentially lead to buffer overflow situations, thus compromising the integrity and stability of the affected systems.

References