CVE-2026-39956

Name of the Vulnerable Software and Affected Versions jq (affected versions not specified)

Description The strindices builtin in src/builtin.c passes arguments to jv string indexes() in src/jv.c without verifying they are strings. Because jv string indexes() relies on assert() checks that are removed in release builds compiled with -DNDEBUG, an attacker can cause a crash by providing input such as strindices(0). Additionally, by crafting a numeric value with an IEEE-754 bit pattern that maps to a specific pointer, a controlled pointer dereference and limited memory read/probe primitive can be achieved. This affects deployments that evaluate untrusted filters against a release build.

Recommendations Apply the fix provided in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.