CVE-2025-48060: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
AddressSanitizer: stack-buffer-overflow in jqfuzzexecute (jvstringvfmt)
Other sources
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = malloc(sz);. As of time of publication, no patched versions are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48060?
The severity of CVE-2025-48060 is considered to be critical due to the potential for heap-buffer-overflow vulnerabilities.
How do I fix CVE-2025-48060?
To fix CVE-2025-48060, users should upgrade jq to version 1.7.2 or later.
What versions of jq are affected by CVE-2025-48060?
CVE-2025-48060 affects jq versions up to and including 1.7.1.
What issues can arise from CVE-2025-48060?
CVE-2025-48060 can lead to application crashes and potential arbitrary code execution.
Is there a workaround for CVE-2025-48060?
There are no recommended workarounds for CVE-2025-48060; the best course of action is to update jq to a secure version.