Out-of-bounds write in jq - CVE-2026-49839

Vulnerability identifier: #VU144354

CSH Severity: High

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-49839

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the --rawfile handling in jv_load_file() when processing an attacker-controlled file. A remote attacker can supply a crafted oversized file to cause a denial of service.

User interaction is required to process the crafted file, and the heap-buffer-overflow occurs in assertion-disabled builds after a handled \"String too long\" error is reused as a string state.

jq
Debian Linux
openEuler
Anolis OS
LANTIME Operating System Firmware (LTOS)
jq (Debian package)
jq-doc
jq-devel
jq
jq-help
jq-debugsource
jq-debuginfo

Install security update from vendor's website.

jq - update to 1.8.2
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
jq (Debian package) - update to 1.7.1-6+deb13u3
jq-doc - update to 1.8.2-1
jq-devel - update to 1.8.2-1
jq - update to 1.8.2-1
jq-help - update to 1.8.2-1
jq-devel - update to 1.8.2-1
jq-debugsource - update to 1.8.2-1
jq-debuginfo - update to 1.8.2-1
jq - update to 1.8.2-1

• https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm

• Multiple vulnerabilities in jq
• Multiple vulnerabilities in Meinberg LANTIME firmware
• Debian update for jq
• openEuler 20.03 LTS SP4 update for jq
• openEuler 24.03 LTS SP3 update for jq
• openEuler 24.03 LTS SP1 update for jq
• openEuler 22.03 LTS SP4 update for jq
• Anolis OS update for jq