Integer Overflow and Buffer Overflow in jq JSON Processor

CVE-2026-32316

What is CVE-2026-32316?

An integer overflow vulnerability exists in the jq JSON processor through version 1.8.1, notably within the jvp_string_append() and jvp_string_copy_replace_bad functions. This flaw arises when concatenating strings that exceed a combined length of 2^31 bytes, leading to a significant buffer allocation miscalculation. As a result, an undersized heap buffer is created, and memory operations may inadvertently write beyond this buffer, causing a heap-based buffer overflow. This vulnerability allows attackers to crash affected systems or exploit the heap corruption, particularly affecting systems that process untrusted jq queries. The root cause stems from the lack of proper size bounds checking for strings, contrasting with established limits for arrays and objects. Mitigations have been implemented in a recent update.

References