jq, a command-line JSON processor, has an integer overflow vulnerability (CWE-190) in versions up to 1.8.1. When the function decNumberFromString processes a number literal with INT_MAX-1 digits (2147483646 digits), the D2U() macro overflows during signed integer arithmetic. This overflow causes the size check for heap allocation to be bypassed, leading the function to use a small 30-byte stack buffer instead. Subsequently, approximately 715 million 16-bit units (~1.4 GiB) are written at an offset 1.43 GiB below the stack frame. The data written is fully attacker-controlled, which can cause significant stack corruption and denial of service.

The vulnerability allows an attacker to cause a large buffer write on the stack with attacker-controlled data, leading to potential denial of service through stack corruption. The CVSS score is 6.2 (medium severity) with no confidentiality or integrity impact, but high availability impact. There are no known exploits in the wild, and no indication of remote exploitation without local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted JSON inputs with extremely large numeric literals in jq versions 1.8.1 and earlier. Monitor vendor channels for updates or official patches.