The flaw stems from an integer overflow in the jvp_string_append() and jvp_string_copy_replace_bad functions of jq when concatenating strings whose total length exceeds 2^31 bytes. The overflow causes the buffer allocation size calculation to under‑allocate the heap buffer, after which a subsequent memory copy writes the full string into this undersized buffer. The result is a heap buffer overflow classified as CWE‑190 and CWE‑122. An attacker can craft jq queries that trigger the overflow, potentially crashing the process or creating conditions for further exploitation through heap corruption.

jq, the command‑line JSON processor from the JQ language community, is affected in all releases through version 1.8.1. Any system that evaluates untrusted jq queries is at risk, as the vulnerable code paths are exercised by user‑supplied query input.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of mitigation instructions and the potential to crash or corrupt memory make it a serious threat. The vulnerability is not listed in CISA’s KEV catalog, indicating no widespread exploitation yet. The likely attack vector is the supply of malicious jq queries via user input, scripts, or configuration files, which directly trigger the overflow.