CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
A heap-buffer-overflow in jq's string formatting function can cause crashes or potentially allow code execution when processing malicious JSON input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48060?
CVE-2025-48060 is a high-severity memory corruption vulnerability in jqlang jq, published on 21 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
Which versions are affected by CVE-2025-48060?
It affects 1 product.
Linux distribution packages (9)
jq SUSE:Linux Enterprise Micro 5.1 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Micro 5.2 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Micro 5.3 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Micro 5.4 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Micro 5.5 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.6-150000.3.9.1 |
jq SUSE:Linux Micro 6.0 | All versions | 1.6-5.1 |
jq openSUSE:Leap 15.6 | All versions | 1.6-150000.3.9.1 |
Products include Jqlang Jq.
How do I fix CVE-2025-48060?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-48060 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48060 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in jqlang jq
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2024-53427 Memory corruption in jq
- CVE-2023-49355 Memory corruption in n/a
- CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
- CVE-2026-54679 jq: potential integer overflow in jvp_string_append
Sources
Also known as ALPINE-CVE-2025-48060, AZL-61968, AZL-61974, BELL-CVE-2025-48060, CLSA-2025-1752749203, DEBIAN-CVE-2025-48060 and 6 more.