CVE-2026-39956: CWE-125: Out-of-bounds Read in jqlang jq
jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-39956) in jq arises from the _strindices builtin passing arguments directly to jv_string_indexes() without verifying they are strings. The jv_string_indexes() function relies on assert() checks that are removed in release builds compiled with -DNDEBUG, allowing attackers to crash jq with crafted input such as _strindices(0). Furthermore, by crafting a numeric value whose IEEE-754 bit pattern corresponds to a chosen pointer, an attacker can achieve controlled pointer dereference and limited memory read. This vulnerability affects jq versions from commit 69785bf7 up to but not including commit fdf8ef0f0. The issue has been patched in commit fdf8ef0f0.
Potential Impact
An attacker who can supply untrusted jq filters to a release build of jq can cause the application to crash (denial of service) and potentially read limited memory contents through controlled pointer dereference. There is no indication of code execution or integrity impact. The vulnerability requires local access to run jq with crafted input and user interaction (UI:R). The CVSS vector indicates low attack complexity and no privileges required but user interaction is needed.
Mitigation Recommendations
A patch fixing this vulnerability has been committed in jq at commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. Users should upgrade to a version including this commit or later. Until patched, avoid evaluating untrusted jq filters in release builds. Patch status is confirmed by the vendor commit reference.
CVE-2026-39956: CWE-125: Out-of-bounds Read in jqlang jq
Description
jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.
CVSS v3.1
Score 6.1medium
Affected software
jqlang
jq
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-39956) in jq arises from the _strindices builtin passing arguments directly to jv_string_indexes() without verifying they are strings. The jv_string_indexes() function relies on assert() checks that are removed in release builds compiled with -DNDEBUG, allowing attackers to crash jq with crafted input such as _strindices(0). Furthermore, by crafting a numeric value whose IEEE-754 bit pattern corresponds to a chosen pointer, an attacker can achieve controlled pointer dereference and limited memory read. This vulnerability affects jq versions from commit 69785bf7 up to but not including commit fdf8ef0f0. The issue has been patched in commit fdf8ef0f0.
Potential Impact
An attacker who can supply untrusted jq filters to a release build of jq can cause the application to crash (denial of service) and potentially read limited memory contents through controlled pointer dereference. There is no indication of code execution or integrity impact. The vulnerability requires local access to run jq with crafted input and user interaction (UI:R). The CVSS vector indicates low attack complexity and no privileges required but user interaction is needed.
Mitigation Recommendations
A patch fixing this vulnerability has been committed in jq at commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. Users should upgrade to a version including this commit or later. Until patched, avoid evaluating untrusted jq filters in release builds. Patch status is confirmed by the vendor commit reference.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T22:40:33.822Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69dd6ed782d89c981f72b22a
Added to database: 04/13/2026, 22:31:51 UTC
Last enriched: 04/21/2026, 06:15:26 UTC
Last updated: 09/13/2026, 10:01:30 UTC
Views: 177
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.