CVE-2026-43894

Name of the Vulnerable Software and Affected Versions jq versions prior to 1.8.2

Description A flaw exists in the decNumberFromString() function when processing a number literal containing 2147483646 digits. This causes the D2U() macro to overflow during signed-int arithmetic, leading to a wrapped negative value that bypasses heap-allocation size checks. Consequently, the function utilizes a 30-byte stack buffer and writes approximately 1.4 GiB of attacker-controlled data at an offset 1.43 GiB below the stack frame.

Recommendations Update to a version later than 1.8.1.