{"id":"CVE-2025-49014","summary":"jq heap use after free vulnerability in f_strflocaltime","details":"jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.","aliases":["GHSA-rmjp-cr27-wpg2"],"modified":"2026-08-18T17:53:15.565811Z","published":"2025-06-19T15:08:04.875Z","related":["openSUSE-SU-2025:15233-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49014.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-416"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49014.json"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-rmjp-cr27-wpg2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49014"},{"type":"FIX","url":"https://github.com/jqlang/jq/commit/499c91bca9d4d027833bc62787d1bb075c03680e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jqlang/jq","events":[{"introduced":"d23a7b9db932be706fecf5f4c9711fd4214bb64e"},{"fixed":"499c91bca9d4d027833bc62787d1bb075c03680e"}],"database_specific":{"extracted_events":[{"introduced":"= 1.8.0"},{"last_affected":"= 1.8.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["= 1.8.0","jq-1.8.0"],"database_specific":{"vanir_signatures_modified":"2026-08-18T17:53:15Z","vanir_signatures":[{"id":"CVE-2025-49014-3e43d7e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/jqlang/jq/commit/499c91bca9d4d027833bc62787d1bb075c03680e","target":{"file":"src/builtin.c","function":"f_strflocaltime"},"deprecated":false,"digest":{"function_hash":"21456594099338338635748615545730557265","length":986}},{"digest":{"line_hashes":["229634195381499058681326750279650833607","230671743281348001652869107249043243754","318781633256137416056698969236056090348","221594159179736934004132549719613449877","300314480822069680885455335287559623124","332789478503690004999524088681419111540","295556432682119296555640261943771039645","223011200396628518572300652305279348205","163071475878479685086128886377381360284","235516793933210745273981392022280828375","81053189470843417409031580521265402663","185208184308688324749959713834010109323","3301820162626082305170999464506940786","320283078681103333539857400143893874706","197542084011474806318153766173779281612","225001260349828254685261580777144476096","2571407476777690373904023816381098686"],"threshold":0.9},"id":"CVE-2025-49014-6e558b7a","signature_type":"Line","signature_version":"v1","source":"https://github.com/jqlang/jq/commit/499c91bca9d4d027833bc62787d1bb075c03680e","target":{"file":"src/builtin.c"},"deprecated":false},{"digest":{"function_hash":"127944034147993421152010928359955530594","length":1289},"id":"CVE-2025-49014-efff44d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/jqlang/jq/commit/499c91bca9d4d027833bc62787d1bb075c03680e","target":{"file":"src/builtin.c","function":"f_strftime"},"deprecated":false}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-49014.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}