CVE-2026-39979

CVE-2026-39979 affects jq’s libjq jv_parse_sized() path when given a non-NUL-terminated counted buffer. The error handling formats the input with %s in jv_string_fmt(), reading until a NUL and ignoring the caller length, which can trigger an out-of-bounds read on malformed input. Exploitation is ...