Use-after-free in jq - CVE-2025-49014

Vulnerability identifier: #VU111309

CSH Severity: High

CVSS v4 BT: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-49014

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the f_strflocaltime() function in /src/builtin.c. A remote attacker can trick the victim into passing a specially crafted JSON file to the application, trigger a heap use-after-free error and execute arbitrary code on the system.

jq
openEuler
Anolis OS
jq
jq-debuginfo
jq-debugsource
jq-devel
jq-help
jq-doc

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

jq - update to 1.8.0-2
jq-debuginfo - update to 1.8.0-2
jq-debugsource - update to 1.8.0-2
jq-devel - update to 1.8.0-2
jq-help - update to 1.8.0-2
jq - update to 1.8.1-1
jq-devel - update to 1.8.1-1
jq-doc - update to 1.8.1-1

• https://github.com/jqlang/jq/security/advisories/GHSA-rmjp-cr27-wpg2

• Use-after-free in jqlang jq
• openEuler update for jq
• Anolis OS update for jq