CVE-2024-53427 Memory corruption in jq

What is CVE-2024-53427?

CVE-2024-53427 is a high-severity memory corruption vulnerability in jqlang jq, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

Weakness: CWE-843

Which versions are affected by CVE-2024-53427?

It affects 1 product.

Products include Jqlang Jq.

How do I fix CVE-2024-53427?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-53427 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53427 exists.

Other vulnerabilities in jqlang jq

• CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow High 8.2
• CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) High 7.7
• CVE-2023-49355 Memory corruption in n/a High 7.5
• CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow High 7.1
• CVE-2026-54679 jq: potential integer overflow in jvp_string_append Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2024-53427, AZL-57376, BELL-CVE-2024-53427, CVE-2024-23338, CVE-2025-25726, DEBIAN-CVE-2024-53427 and 5 more.