Vulnerability Description
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jqlang | Jq | <= 1.7.1 |
Related Weaknesses (CWE)
References
- https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5wExploitVendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/09/msg00022.html
- https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5wExploitVendor Advisory
FAQ
What is CVE-2025-48060?
CVE-2025-48060 is a vulnerability with a CVSS score of 7.5 (HIGH). jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happ...
How severe is CVE-2025-48060?
CVE-2025-48060 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-48060?
Check the references section above for vendor advisories and patch information. Affected products include: Jqlang Jq.