CVE-2025-49014: 
Alma Linux vulnerability analysis and mitigation

CVE-2025-49014 is a heap use-after-free vulnerability in jq, the popular command-line JSON processor, specifically within the f_strflocaltime function in src/builtin.c. It was introduced in jq version 1.8.0 and disclosed on June 18–19, 2025. The vulnerability was discovered through fuzzing and reported by researcher sofiaaberegg. It carries a CVSS v4.0 base score of 5.5 (Medium) and is classified as Low severity by the upstream advisory (GitHub Advisory, Red Hat Bugzilla, Oracle).

The root cause is a use-after-free (CWE-416) in the f_strflocaltime function. The bug occurs because the format string pointer (fmt) is read after the underlying jv object (b) has been freed via jv_free(b). Specifically, the condition (n == 0 && *fmt) dereferences fmt after the memory it points to has been released, leading to a heap use-after-free. The fix (commit 499c91b) captures the emptiness of the format string in a local variable (fmt_not_empty) before freeing b, so the freed memory is never accessed afterward. A proof-of-concept jq filter file (heap-use-after-free.jq) was included in the advisory and confirmed with AddressSanitizer output (GitHub Advisory, GitHub Commit).

Successful exploitation can cause jq to crash (denial of service) due to the heap use-after-free condition, resulting in abnormal process termination. The vulnerability has no known confidentiality or integrity impact — the primary risk is availability loss for applications or pipelines that rely on jq for JSON processing. In environments where jq processes untrusted or attacker-controlled JSON input (e.g., in automated pipelines or web services), an attacker could trigger repeated crashes to disrupt operations (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit file (heap-use-after-free.jq) was published as part of the GitHub Security Advisory, demonstrating the crash via AddressSanitizer. The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Identify target: Locate systems or pipelines running jq version 1.8.0 that process attacker-influenced input using the strflocaltime built-in function.
2. Craft malicious jq filter: Create a jq filter that invokes strflocaltime with an empty string format derived from a function (e.g., strflocaltime("" | ., @uri)), which triggers the use-after-free condition.
3. Supply input: Pass the crafted filter and a numeric input (e.g., 0) to the jq binary: ./jq -nf heap-use-after-free.jq.
4. Trigger crash: The f_strflocaltime function frees the format string's backing memory via jv_free(b), then dereferences the now-freed pointer, causing a heap use-after-free and process abort (GitHub Advisory).

• Process: Unexpected termination or crash of the jq process, particularly when processing JSON with strflocaltime filters; AddressSanitizer output referencing f_strflocaltime in src/builtin.c:1826.
• Logs: Application or system logs showing jq aborting with signals (e.g., SIGABRT, SIGSEGV) or error messages such as AddressSanitizer: heap-use-after-free.
• File System: Presence of unusual jq filter files (e.g., files invoking strflocaltime with empty or piped format strings) in script or temp directories.

The upstream fix is available in commit 499c91b on the jqlang/jq GitHub repository, but no official patched release version had been published at the time of disclosure. Oracle addressed this in Oracle Solaris 11.4 via the October 2025 Third Party Bulletin. Red Hat is tracking the issue under Bugzilla ID 2373892. Until a patched release is available, users should restrict jq usage to trusted input sources, avoid using strflocaltime with untrusted or dynamically generated format strings, and consider sandboxing jq processes. Upgrading to a patched release as soon as one is published is the recommended long-term remediation (GitHub Commit, Oracle, Red Hat Bugzilla).

The vulnerability was noted in the security community shortly after disclosure, with aggregators such as Vulners, VulDB, and CVEFeed picking it up within hours of publication. A Mastodon post on infosec.exchange referenced the CVE on June 19, 2025. The advisory was rated Low severity by the jq maintainers, and community reaction has been muted given the limited impact scope. Oracle included it in their October 2025 Solaris Third Party Bulletin, and Valve's SteamOS 3.7.15 update (September 2025) also addressed this CVE as part of security fixes for the platform (GitHub Advisory, Oracle).