CVE-2026-54679

The vulnerability is located in the jvp_string_append function of the jq JSON processor. On 32-bit systems, the function may overflow its integer and multiplier variables when processing input, which can lead to a massive buffer overrun. This overflow can corrupt adjacent memory, potentially resulting in arbitrary code execution or causing a crash that may disrupt service availability. The weakness is classified as CWE-190.

All installations of jq prior to version 1.8.2 running on 32-bit architectures are affected. The vendor jqlang:jq released a fix in the 1.8.2 release. Any deployment that continues to use older jq binaries on 32-bit hardware must be identified and upgraded.

Based on the description, it is inferred that an attacker who can supply or influence input parsed by jq could potentially trigger the overflow. The likely attack vector would involve providing specially crafted JSON data that causes jvp_string_append to overflow. The CVSS score of 6.9 indicates a moderate to high severity impact. EPSS data is not available, so the likelihood of exploitation is not quantified. The vulnerability is not listed in the CISA KEV catalog. Without further information, the possibility of successful exploitation remains uncertain, but the existence of a buffer overrun implies that exploitation could lead to arbitrary code execution or denial of service if conditions are met.