The issue originates from an out‑of‑bounds read that occurs in the error‑handling path of the jv_parse_sized() API when it formats a counted buffer with the %s specifier, ignoring the supplied length. Because the format expects a NUL‑terminated string, reading past the buffer boundary can expose arbitrary memory contents or cause an application termination. This flaw is identified as a classic out‑of‑bounds read (CWE‑125) and would only be triggered when malformed JSON that lacks a NUL terminator is processed.

Any installation of jq that includes libjq code prior to commit 2f09060afab23fe9390cce7cb860b10416e1bf5f is affected. This encompasses all versions of the command‑line tool and any program that links against the older libjq library and calls jv_parse_sized() with external input. The patch removes the vulnerable string formatting and correctly respects the buffer length, restoring safe error construction.

The CVSS score of 6.9 indicates moderate severity. Based on the description, the vulnerability can be reached by any program or service that supplies untrusted JSON to the library. Thus the attack vector is effectively any context where external data is parsed—such as command line usage, web servers, or embedded scripts. Exploitation would require an attacker to craft malformed, non‑NUL‑terminated JSON; this yields either a memory disclosure or a crash. The absence of an EPSS score and lack of listing in CISA’s KEV catalog suggests no known widespread exploitation, but the issue remains reachable and potentially damaging.