CVE-2025-48060

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-480615.6wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being CVE-2025-480626.1Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, an CVE-2025-480638.8XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part CVE-2025-480643.3GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convinc CVE-2025-480656.1Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a fie CVE-2025-480665.5wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function CVE-2025-480674.6OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerab CVE-2025-480684.3Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before CVE-2025-480696.6ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a CVE-2025-48077.5A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unkno CVE-2025-480704.3Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to ch CVE-2025-480717.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus