The jq utility, used for processing JSON data on the command line, contains two security flaws: a signed integer overflow in the function jvp_array_write (CVE-2024-23337) and a stack-buffer-overflow identified in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060). Both vulnerabilities could potentially lead to memory corruption issues. Red Hat has released an update for jq in Red Hat Enterprise Linux 9.2 to address these flaws. The advisory references the Red Hat Security Advisory RHSA-2025:10615 and provides updated packages for multiple architectures. No CVSS scores are provided in the advisory, but the impact is assessed as moderate.

The vulnerabilities could allow an attacker to cause memory corruption through integer overflow or buffer overflow conditions when processing JSON data with jq. This may lead to application crashes or potentially other unintended behavior. Red Hat rates the security impact as moderate. There are no known exploits in the wild reported at this time.

Red Hat has released an official security update for jq in Red Hat Enterprise Linux 9.2 (package version 1.6-15.el9_2.2) that addresses these vulnerabilities. Users should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official patch.