The vulnerability (CVE-2026-39956) in jq arises from the _strindices builtin passing arguments directly to jv_string_indexes() without verifying they are strings. The jv_string_indexes() function relies on assert() checks that are removed in release builds compiled with -DNDEBUG, allowing attackers to crash jq with crafted input such as _strindices(0). Furthermore, by crafting a numeric value whose IEEE-754 bit pattern corresponds to a chosen pointer, an attacker can achieve controlled pointer dereference and limited memory read. This vulnerability affects jq versions from commit 69785bf7 up to but not including commit fdf8ef0f0. The issue has been patched in commit fdf8ef0f0.

An attacker who can supply untrusted jq filters to a release build of jq can cause the application to crash (denial of service) and potentially read limited memory contents through controlled pointer dereference. There is no indication of code execution or integrity impact. The vulnerability requires local access to run jq with crafted input and user interaction (UI:R). The CVSS vector indicates low attack complexity and no privileges required but user interaction is needed.

A patch fixing this vulnerability has been committed in jq at commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. Users should upgrade to a version including this commit or later. Until patched, avoid evaluating untrusted jq filters in release builds. Patch status is confirmed by the vendor commit reference.