This vulnerability in jqlang jq (up to version 1.6) involves a reachable assertion failure in the run_jq_tests function within the jq_test.c source file. The flaw can be triggered by a local attacker manipulating inputs to cause an assertion to be reached, potentially leading to a denial of service or application crash. The vulnerability requires local access and does not involve user interaction or elevated privileges beyond local user rights. The CVSS 4.8 score reflects medium severity with local attack vector and low complexity.

The impact is limited to local users who can execute or manipulate the jq testing function, potentially causing the application to assert and terminate unexpectedly. This may lead to denial of service conditions but does not indicate remote code execution or privilege escalation. No known exploits in the wild have been reported.

No official patch or remediation has been disclosed by the vendor at this time. Since the vulnerability requires local access and affects a testing function, restricting local access to trusted users and avoiding use of vulnerable jq test components may reduce risk. Monitor the vendor advisory for updates and apply patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.