CVE-2026-54679CWE-190

jq: potential integer overflow in jvp_string_append

Medium · published June 25, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-06-25T17:16Z
EPSS history
Timeline
  • 25 JUN 17:16Z
    jq: potential integer overflow in jvp_string_append
    cvelistv5