In jq versions 1.8.1 and earlier, a filter file loaded with the -f option is truncated at the first NUL byte. A crafted file containing a legitimate prefix, a NUL byte, and arbitrary suffix compiles and executes only the prefix, leaving jq with a prefix/full-buffer mismatch on the compilation path. The resulting mismatch could lead to unpredictable execution of the filter logic or a denial of service, but current evidence does not demonstrate remote code execution.

The vulnerable software is jq, version 1.8.1 and earlier, distributed by jqlang:jq. Any system running these versions that allows users to supply filter files via the -f option is exposed.

The CVSS score of 5.5 reflects a moderate impact. EPSS is not available and the vulnerability is not listed in CISA KEV. Attackers must be able to supply a filter file to jq; therefore the attack vector is local or via an application that uses jq. Once the file is processed, the truncation can lead to unexpected behavior or denial of service but does not by itself grant arbitrary code execution.