CVE-2025-48060
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
- Score
- CVSS 4.0 7.7 High
- Status
- Modified - security-advisories@github.com
- Published
- 2025-05-21
- Last modified
- 2025-11-03
- Weaknesses
- CWE-121, CWE-787
Affected products
References
- https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5w
- https://lists.debian.org/debian-lts-announce/2025/09/msg00022.html
