jq is a JSON processor whose jv_parse_sized() API accepts a buffer with an explicit length parameter. Prior to commit 2f09060afab23fe9390cce7cb860b10416e1bf5f, the error handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator rather than respecting the supplied length. This causes an out-of-bounds read when the buffer is not NUL-terminated and contains malformed JSON. The vulnerability can be triggered by any consumer of libjq calling jv_parse_sized() with untrusted input, potentially causing memory disclosure or process termination. The issue has been patched in the specified commit.

The vulnerability allows an out-of-bounds read beyond the end of a non-NUL-terminated input buffer when malformed JSON is processed. This can lead to disclosure of memory contents or cause the process to terminate unexpectedly. The impact depends on memory layout and usage context. There are no known exploits in the wild as of the published date.

A patch fixing this vulnerability has been committed in jq at commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. Users and consumers of libjq should upgrade to a version including this commit or later to remediate the issue. Patch status is not explicitly stated beyond the commit; verify with the vendor or project repository for official releases containing the fix.