jq’s handling of the --rawfile option can produce a heap‑buffer‑overflow in assertion‑disabled builds when an attacker supplies a file that causes the string accumulator to exceed its limits. The error handling recycles an invalid string object, allowing subsequent appends to write past the allocated memory. This out‑of‑bounds write can corrupt process memory, potentially leading to arbitrary code execution or program crashes. The flaw is a classic heap overflow identified as CWE‑787.

The vulnerability affects the jq command‑line JSON processor from jqlang. Versions before 1.8.2 are impacted; the flaw is corrected in the 1.8.2 release and later. It is triggered when jq –‑rawfile reads a file that is controlled or crafted by an attacker.

The CVSS score of 7.1 indicates medium‑to‑high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a file path to jq –‑rawfile, which implies a local or privileged access vector. If the program is executed with assertions disabled—as is common in production builds—the flaw can be realized, making systems that use jq in automated scripts or services at notable risk.