A signed integer overflow in jq’s bytecode VM stack allocation causes the stack size to wrap around when it exceeds roughly one gigabyte. The wrapped value is then passed to realloc and later used in a memmove with attacker‑influenced offsets, enabling the attacker to corrupt memory. This flaw is an integer overflow combined with a buffer overflow, which can lead to arbitrary memory corruption and potentially arbitrary code execution, as defined by CWE‑190 and CWE‑787.

The affected product is jq from jqlang. Versions 1.8.1 and earlier are vulnerable. No other vendor or product versions are impacted according to the CNA information.

The overall CVSS score is 6.4, reflecting moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or author‑controlled use of jq; an attacker can supply deeply nested generator forks through command‑line input to trigger the overflow. The content of the input can influence the signed integer calculation and the subsequent memory operations, so the flaw is exploitable when the attacker controls or can influence the JSON data processed by jq.