CVE-2025-48060 HIGH

CVE-2025-48060: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)

Vendor Jqlang
Product jq
Weakness CWE-121
Published May 21, 2025
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.

Key dates

02Disclosure timeline

May 21, 2025 CVE published
November 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-34285 NETGEAR RAX30 cmsCli_authenticate Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2023-39277 CVE-2023-35725 D-Link DAP-2622 DDP User Verification Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2021-1213 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities CVE-2025-14992 Tenda AC18 HTTP Request GetParentControlInfo strcpy stack-based overflow