CVE-2026-41257— jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41257
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
Source: NVD (National Vulnerability Database)
Vulnerability Description
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
整数溢出或超界折返
Source: NVD (National Vulnerability Database)
Vulnerability Title
jq 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
jq是jqlang开源的一个轻量级且灵活的命令行 JSON 处理器。 jq 1.8.1及之前版本存在输入验证错误漏洞，该漏洞源于jq字节码虚拟机数据栈分配大小使用有符号整数，当栈增长超过约1 GiB时，倍增算术溢出，可能导致传递给realloc的包装值被用于攻击者影响偏移量的memmove操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41257
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41257
请登录查看更多情报信息。
- https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-41257
Same Patch Batch · jqlang · 2026-05-11 · 7 CVEs total
| CVE-2026-43896 | 6.2 MEDIUM | jq: Stack Overflow in Recursive Object Merge |
| CVE-2026-43894 | 6.2 MEDIUM | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro |
| CVE-2026-41256 | 5.5 MEDIUM | jq: Embedded NUL truncates top-level jq programs loaded with -f |
| CVE-2026-43895 | 4.4 MEDIUM | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sen |
| CVE-2026-40612 | jq: Stack overflow via unbounded recursion in jv_contains | |
| CVE-2026-44777 | jq: stack overflow in module loading on mutual `include` |
IV. Related Vulnerabilities
Same product: jq
- CVE-2026-43896
jq: Stack Overflow in Recursive Object Merge - CVE-2026-43895
jq: Embedded NUL in jq import paths causes local redaction-p - CVE-2026-44777
jq: stack overflow in module loading on mutual `include` - CVE-2026-43894
jq: Wild stack write via signed-integer overflow in decNumbe - CVE-2026-41256
jq: Embedded NUL truncates top-level jq programs loaded with
Same vendor: jqlang
- CVE-2026-43896
jq: Stack Overflow in Recursive Object Merge - CVE-2026-43895
jq: Embedded NUL in jq import paths causes local redaction-p - CVE-2026-44777
jq: stack overflow in module loading on mutual `include` - CVE-2026-43894
jq: Wild stack write via signed-integer overflow in decNumbe - CVE-2026-41256
jq: Embedded NUL truncates top-level jq programs loaded with
Same weakness: CWE-190
- CVE-2026-33642
Kitty has a Heap Buffer Over-Read/Write via Integer Overflow - CVE-2026-27781
kernel_liteos_a has an integer overflow vulnerability - CVE-2026-32849
NetBSD Signed Integer Overflow in cryptodev_op via cryptodev - CVE-2021-26380
AMD Graphics Driver 输入验证错误漏洞 - CVE-2026-44673
libyang: lyb_read_string() integer overflow → heap buffer ov
V. Comments for CVE-2026-41257
No comments yet