CVE-2026-32316

OVERVIEW CVE-2026-32316 is an integer overflow vulnerability affecting jq, a command-line JSON processor, through version 1.8.1. The flaw exists in the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with combined lengths exceeding 2^31 bytes triggers a 32-bit unsigned integer overflow during buffer allocation size calculation. This results in a drastically undersized heap buffer that is subsequently overflowed during memory copy operations. Any system processing untrusted jq queries is potentially affected. SEVERITY The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, indicating an attacker can reliably exploit the flaw. While the confidentiality and integrity impacts are limited, the availability impact is rated as high, meaning an attacker can reliably crash the jq process through denial of service. The underlying issue combines an integer overflow (CWE-190) with heap-based buffer overflow (CWE-122), creating potential for both immediate crashes and possible heap corruption leading to further exploitation. EXPLOITATION STATUS No active exploitation has been reported. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on the Hot List, indicating minimal real-world exploitation activity to date. The EPSS score of 0.00053 reflects very low probability of exploitation in the wild compared to other vulnerabilities. The issue was remediated in commit e47e56d226519635768e6aab2f38f0ab037c09e5, and users should upgrade to patched versions.