CVE-2026-32316 is a heap-based buffer overflow vulnerability in jq versions before commit e47e56d226519635768e6aab2f38f0ab037c09e5. The flaw is caused by an integer overflow in the buffer allocation size calculation within the jvp_string_append() and jvp_string_copy_replace_bad functions when concatenating strings exceeding 2^31 bytes. This results in allocating a buffer that is too small, leading to a heap overflow when the full string data is copied. The root cause is the lack of string size bounds checking, unlike other jq data types. This vulnerability can cause denial of service via process crashes or potentially enable further exploitation through heap corruption. The issue has been addressed by the vendor in the specified commit.

The vulnerability allows an attacker to crash the jq process by triggering a heap buffer overflow through crafted queries that produce extremely large strings. This can result in denial of service. Additionally, heap corruption caused by the overflow may allow further exploitation, although no known exploits are reported in the wild. The vulnerability does not directly impact confidentiality but affects integrity and availability.

A fix for this vulnerability has been implemented in jq at commit e47e56d226519635768e6aab2f38f0ab037c09e5. Users should upgrade to a version including this commit or later to remediate the issue. Patch status is confirmed by the vendor commit reference. No other mitigation actions are indicated.