CVE-2026-39979

VULNERABILITY OVERVIEW CVE-2026-39979 affects jq, a widely-used command-line JSON processor, and specifically impacts the jv_parse_sized() API in the libjq library. The vulnerability stems from a buffer handling flaw where error-handling code fails to respect an explicitly-provided buffer length parameter, instead reading until a NUL terminator is found. This creates an out-of-bounds read condition when malformed JSON is passed in non-NUL-terminated buffers. SEVERITY ASSESSMENT The vulnerability is reachable through any libjq consumer that calls jv_parse_sized() with untrusted input, making the attack vector straightforward for applications integrating this library. The flaw can result in memory disclosure or process termination depending on memory layout, though the CVSS score is not yet published. With an EPSS score of 0.00055 and FAUCET Risk Score of 46.0/100, the vulnerability presents moderate concern within the broader threat landscape. EXPLOITATION STATUS There is no evidence of active exploitation, and the vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f, and organizations should prioritize updating to patched versions of jq and any dependent applications. Community attention appears minimal at this stage, with the vulnerability remaining on the inactive Hot List.