Back to Database
Status published
Medium
CVE-2025-49014
jq heap use after free vulnerability in f_strflocaltime
Vulnerability Description
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-49014
Credits & Attribution
No credits recorded in the NVD database.
References
More from jqlang
View All →CVE-2025-9403
jqlang jq JSON jq_test.c run_jq_tests assertion
Medium
4.8
CVE-2025-48060
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
High
7.7
CVE-2024-53427
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly...
High
8.1
CVE-2024-23337
jq has signed integer overflow in jv.c:jvp_array_write
Medium
4.3
CVE-2023-50268
jq has stack-based buffer overflow in decNaNs
Medium
6.2
Affected Vendor
jqlang
View all reports →Affected Software
jq
Vulnerable Versions:
= 1.8.0
Timeline
Official Publish:
June 19th, 2025
Last Modified:
June 23rd, 2025
Added to House:
July 22nd, 2026