CVE-2025-48060

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48060
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48060.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-48060
Aliases
  • GHSA-p7rr-28xf-3m5w
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CLSA (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHSA (10)
RLSA (3)
ROOT (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (5)
Published
2025-05-21T17:32:43Z
Modified
2026-08-12T03:30:52Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
Details

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-121"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48060.json"
}
References

Affected packages

Git / github.com/jqlang/jq

Affected ranges

Type
GIT
Repo
https://github.com/jqlang/jq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.7.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.6rc2
jq-1.*
jq-1.0
jq-1.1
jq-1.2
jq-1.3
jq-1.4
jq-1.5rc1
jq-1.5rc2
jq-1.6
jq-1.6rc1
jq-1.7
jq-1.7.1
jq-1.7rc1
jq-1.7rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48060.json"