CVE-2025-49014CWE-416

jq heap use after free vulnerability in f_strflocaltime

Medium · published June 19, 2025

CVSS v4.0
5.5
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-06-19T15:08Z
EPSS history
Timeline
  • 19 JUN 15:08Z
    jq heap use after free vulnerability in f_strflocaltime
    cvelistv5