The vulnerability arises from the _strindices builtin passing arguments directly to a string indexer without validating that the input is actually a string. In a release build, missing assertions allow the function to dereference a pointer derived from an arbitrary numeric value. This results in a program crash, and by crafting a numeric payload that maps to a chosen IEEE‑754 bit pattern, an attacker can read small amounts of memory around that pointer. The effect is a denial‑of‑service condition and limited memory disclosure. The weakness maps to dereference of null or invalid pointers and misuse of type casting.

The affected product is jq, a command‑line JSON processor maintained by the jqlang community. All jq releases built after commit 69785bf77f86e2ea1b4a20ca86775916889e91c9, up to the patched commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, are vulnerable. Specific version ranges are not enumerated but any distribution package containing jq built from source before the patch is susceptible.

The CVSS base score of 6.1 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower exploitation probability in the wild. The attack vector is likely local: a user who can supply or influence a jq filter can trigger the crash or trigger the memory read primitive. In contexts where jq processes untrusted input in a server or privileged environment, the danger escalates to a remote denial‑of‑service. The exploitation requires only the presence of a vulnerable jq binary and crafted input, making it relatively easy to perform once the target is known.