CVE-2026-39956

A flaw was found in jq, a command line JSON processor. In release builds, the _strindices builtin function calls the jv_string_indexes function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.

To exploit this flaw, a user needs to process JSON input with an attacker-supplied argument to the _strindices builtin. This allows the attacker to cause an application crash and a limited memory read with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use untrusted input as an argument to a jq builtin, specifically '_strindices'.