CVE-2026-41257 jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
An integer overflow in jq's VM stack allows attackers to trigger memory corruption via deeply nested JSON, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41257?
CVE-2026-41257 is a medium-severity vulnerability in jqlang jq, published on 11 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
Which versions are affected by CVE-2026-41257?
It affects 1 product.
Products include Jqlang Jq.
How do I fix CVE-2026-41257?
Upgrade to a fixed version.
Is CVE-2026-41257 being exploited?
There is no known exploitation of CVE-2026-41257 in the wild and no public exploit code.
Other vulnerabilities in jqlang jq
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2024-53427 Memory corruption in jq
- CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
- CVE-2023-49355 Memory corruption in n/a
- CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
Sources
Also known as ALPINE-CVE-2026-41257, AZL-86369, BELL-CVE-2026-41257, DEBIAN-CVE-2026-41257, ECHO-5cb6-067b-5460, GHSA-4jm8-m363-4539 and 1 more.