jq versions 1.8.1 and earlier contain an integer overflow vulnerability in the bytecode VM's data stack allocation size tracking. The stack size is tracked using a signed int, and when it grows beyond roughly 1 GiB, the doubling operation overflows, resulting in a wrapped value being passed to realloc. This wrapped value is then used as an offset in a memmove operation, which can be influenced by an attacker through deeply nested generator forks, potentially causing memory corruption.

The integer overflow can cause memory corruption within the jq process, which may lead to crashes or potentially exploitable conditions. The vulnerability requires local access with the ability to supply deeply nested generator forks to trigger the overflow. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing JSON inputs that cause deeply nested generator forks exceeding approximately 1 GiB of stack growth. Monitor vendor channels for updates and apply official patches once released.