Read the docs
TI-2025-30431 Aliases CVE-2025-48060

AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)

Priority HIGH 73CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 16 advisoriesRed Hat: 25 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jqlangjqup to 1.7.1—No fix listedCNA
  • jq Vendorjqlang Affected up to 1.7.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*up to 1.7.1Vulnerablejqlang
  • cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:* Versions up to 1.7.1 Vulnerable ·jqlang

Remediation

Red Hat 16 advisories

  • RHSA-2025:15672 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202509030117-0
  • RHSA-2025:14853 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.14.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202508270040-0, rhcos-ppc64le-414.92.202508270040-0, rhcos-s390x-414.92.202508270040-0 +1
  • RHSA-2025:14396 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.15.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202508192014-0, rhcos-ppc64le-415.92.202508192014-0, rhcos-s390x-415.92.202508192014-0 +1
Show 13 more Red Hat advisories
  • RHSA-2025:12882 Released 2025-08-05 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 10) jq-1.7.1-8.el10_0.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) jq-devel-1.7.1-8.el10_0.1
  • RHSA-2025:11677 Released 2025-07-30 · Red Hat rating Important
    OpenShift Container Platform 4.18.21 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ose-agent-installer-csr-approver-rhel9, openshift4/ose-aws-cluster-api-controllers-rhel9, openshift4/ose-ibm-vpc-block-csi-driver-rhel9 +1
  • RHSA-2025:11681 Released 2025-07-30 · Red Hat rating Important
    OpenShift Container Platform 4.16.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2025:11363 Released 2025-07-22 · Red Hat rating Important
    OpenShift Container Platform 4.19.5 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos
  • RHSA-2025:10618 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream (v. 8) jq-1.6-11.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) jq-devel-1.6-11.el8_10
  • RHSA-2025:10620 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) jq-1.6-3.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) jq-1.6-3.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) jq-1.6-3.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) jq-1.6-3.el8_6.1
  • RHSA-2025:10622 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) jq-1.5-12.el8_2.1
  • RHSA-2025:10621 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) jq-1.5-12.el8_4.4
  • RHSA-2025:10619 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) jq-1.6-6.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) jq-1.6-6.el8_8.3
  • RHSA-2025:10615 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jq-1.6-15.el9_2.2
  • RHSA-2025:10616 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) jq-1.6-12.el9_0.1
  • RHSA-2025:10613 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) jq-devel-1.6-16.el9_4.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) jq-1.6-16.el9_4.1
  • RHSA-2025:10585 Released 2025-07-08 · Red Hat rating Moderate
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 9) jq-1.6-17.el9_6.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jq-devel-1.6-17.el9_6.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:10613
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:10618
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:10622
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:10621
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:10620
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:10620
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:10619
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:10616
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:10615
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2025:10620
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:10620
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:10619
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:12882
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:10585
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:10613
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:10618
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:12882
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:10585
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15672
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:14853
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:14396
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:11681
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:12437
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:11677
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:11363
Not affected: 4 products
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48060

References

Exploit 1

  • TI-2026-24844 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow CVSS 3.1HIGH 8.2
  • TI-2023-26962 decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via… CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2024-35799 Type confusion in jqlang jq CVSS 3.1HIGH 8.1
  • TI-2026-36743 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow CVSS 3.1HIGH 7.1
  • TI-2024-15439 jq has signed integer overflow in jv.c:jvp_array_write CVSS 3.1MEDIUM 6.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences