CVE-2024-53427 - CVE House
Back to Database
Status published High CVE-2024-53427

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly...

Vulnerability Description

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-53427

Credits & Attribution

No credits recorded in the NVD database.

References

More from jqlang

View All →
CVE-2025-9403
jqlang jq JSON jq_test.c run_jq_tests assertion
Medium 4.8
CVE-2025-49014
jq heap use after free vulnerability in f_strflocaltime
Medium 5.5
CVE-2025-48060
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
High 7.7
CVE-2024-23337
jq has signed integer overflow in jv.c:jvp_array_write
Medium 4.3
CVE-2023-50268
jq has stack-based buffer overflow in decNaNs
Medium 6.2

Affected Vendor

Affected Software

jq
Vulnerable Versions:
0

Timeline

Official Publish: February 26th, 2025
Last Modified: March 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-843

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact