jq, a command-line JSON processor, suffers from an integer overflow in the decNumberFromString function when handling extremely large number literals (INT_MAX-1 digits). The D2U() macro overflows signed-int arithmetic, resulting in a wrapped negative value that bypasses heap allocation size checks. Consequently, the function uses a small stack buffer (30 bytes) but writes approximately 1.4 GiB of attacker-controlled data at a large negative offset relative to the stack frame. This can cause a significant stack-based buffer overflow and potential denial of service. The vulnerability affects jq versions up to and including 1.8.1.

The vulnerability can lead to a denial of service due to a large stack buffer overflow with attacker-controlled data. There is no indication from the provided data that confidentiality or integrity are impacted. No known exploits are reported in the wild. The CVSS vector indicates local attack vector with low complexity and no privileges or user interaction required, but only availability impact is noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted JSON inputs with jq versions 1.8.1 and earlier. Monitor vendor channels for updates regarding patches or workarounds.