CVE-2025-48060

What it actually does

Heap buffer overflow in jv_string_vfmt caused by allocating a buffer via malloc without sufficient size validation, allowing out-of-bounds writes during JSON string formatting.

Why it matters to the business

Processing untrusted JSON inputs with affected jq versions can crash command-line tools or applications, disrupting data pipelines and potentially enabling arbitrary code execution in environments that embed jq.

How an attack unfolds

An attacker supplies a specially crafted JSON document that reaches jv_string_vfmt with an oversized format string, triggering the undersized malloc allocation and subsequent overflow to corrupt heap memory.

How to fix it

Upgrade to the first patched release of jq once available; in the interim, replace jq usage with alternative JSON processors or sanitize inputs before processing.

How to confirm the fix worked

Run jq --version to confirm the installed release exceeds 1.7.1; re-execute the oss-fuzz harness or equivalent fuzzing suite against the updated binary to verify absence of the crash.

Typical attack path

1. Identify a target process or script that invokes jq on attacker-controlled JSON
2. Craft a malicious JSON payload containing an oversized or malformed string format specifier
3. Deliver the payload via file, pipe, or API that reaches the vulnerable jq version
4. Trigger jv_string_vfmt execution to induce heap corruption and potential control-flow hijacking

How to detect it

Search process execution logs and command histories for jq invocations on external or untrusted JSON sources; inspect core dumps or sanitizer reports for heap-buffer-overflow signatures originating from jv.c.

What your security team should do

• Inventory all systems and containers using jq <= 1.7.1 and prioritize replacement
• Block untrusted JSON from reaching jq until a fixed version is deployed
• Monitor upstream jq releases for the security patch and apply immediately upon availability