MEDIUM
CVE-2026-54679
CVSS
5.5
Description
jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.
Summary dbcve.org
jq versions prior to 1.8.2 contain an integer/multiple overflow vulnerability in the jvp_string_append function on 32-bit systems, which can lead to a buffer overrun. This flaw exists specifically in how the function handles string length calculations on 32-bit architectures.
Mitigation
Upgrade jq to version 1.8.2 or later to patch the integer overflow vulnerability in jvp_string_append; on 32-bit systems, ensure the patched version is deployed.
Weakness (CWE)
CWE-190
Integer Overflow
EPSS Score
0.1%
Probability of exploitation in next 30 days
1.1th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.