Heap Buffer Overflow Vulnerability in jq Command-Line JSON Processor

CVE-2026-49839

What is CVE-2026-49839?

A heap buffer overflow vulnerability exists in jq, a command-line JSON processor, affecting versions prior to 1.8.2. This issue arises when using the '--rawfile' option, which can lead to an invalid state if an attacker controls the input file. The vulnerability occurs due to improper string handling when reading chunks from the file, causing jq to repeatedly append data beyond its limits. This improper handling can lead to heap-buffer-overflow conditions in builds without assertions, creating potential opportunities for exploitation.

References