CVE-2025-9403: 
NixOS vulnerability analysis and mitigation

CVE-2025-9403 is a reachable assertion vulnerability (CWE-617) in the jq JSON processor (jqlang/jq) affecting versions up to and including 1.6. The flaw resides in the run_jq_tests function within jq_test.c and is triggered by malformed JSON input containing invalid Unicode escape sequences, causing an assertion failure and program termination via SIGABRT. It was first reported on August 12, 2025 (via GitHub issue), publicly disclosed on August 25, 2025, and assigned a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, GitHub Issue). The vulnerability also appears in Oracle Solaris 11.4 as a third-party component (Oracle) and in Microsoft CBL-Mariner packages (Microsoft MSRC).

The root cause is an inconsistency in jq's JSON parsing and serialization logic when processing malformed Unicode escape sequences (CWE-617: Reachable Assertion). During test suite execution, the run_jq_tests() function in src/jq_test.c at line 204 invokes jv_equal(jv_copy(expected), jv_copy(reparsed)) to validate that expected and reparsed JSON values match; when malformed input is supplied, the parser detects an INVALID_CHARACTER syntax error but the subsequent comparison between expected and reparsed values fails, triggering assert() and a SIGABRT signal. The call chain is: main() → jq_testsuite() → run_jq_tests() → assertion failure. Exploitation requires local access and the ability to supply a crafted input file to jq invoked with --run-tests; a proof-of-concept input file was publicly disclosed by researchers Xudong Cao and Yuqing Zhang (UCAS) (GitHub Issue).

Successful exploitation causes abnormal termination of the jq process via SIGABRT, resulting in a denial of service (availability impact only). There is no confidentiality or integrity impact, as the vulnerability does not allow code execution, data exfiltration, or data modification. The impact is limited to the local system and specifically to jq processes invoked with the --run-tests flag against malformed input, making it primarily a concern for automated test pipelines or environments where untrusted JSON input is processed through jq's test suite (GitHub Issue, Red Hat Bugzilla).

A proof-of-concept input file has been publicly disclosed via Google Drive and referenced in the GitHub issue, making the vulnerability reproducible by any local user with access to the jq binary (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to pass a crafted file to jq using the --run-tests invocation mode.

1. Prepare the environment: Obtain a system with jq version 1.6 or earlier installed and local user access.
2. Obtain or craft the malicious input: Download or create a malformed JSON file containing invalid Unicode escape sequences (a PoC file, POC_jq_assertion_failure_test_suite_parsing, was publicly disclosed via Google Drive).
3. Invoke jq with the test suite flag: Execute jq with the --run-tests option pointing to the malformed file, e.g.:

   jq -c --compact-output --library-path <path> --debug-trace=all --run-tests . POC_jq_assertion_failure_test_suite_parsing

4. Trigger the assertion failure: The jq parser encounters an INVALID_CHARACTER at column 6, and the subsequent jv_equal(jv_copy(expected), jv_copy(reparsed)) assertion at src/jq_test.c:204 fails, causing SIGABRT and process termination.
5. Observe the crash: The program outputs an assertion failure message and aborts, achieving a denial of service of the jq process (GitHub Issue).

• Process: Unexpected termination of jq processes with SIGABRT (signal 6); core dump files generated by jq in the working directory.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing entries like jq: src/jq_test.c:204: void run_jq_tests(...): Assertion 'jv_equal(jv_copy(expected), jv_copy(reparsed))' failed. followed by Aborted.
• File System: Presence of unusual or unexpected input files passed to jq with --run-tests; PoC files with malformed Unicode sequences in directories accessible to jq.
• Network: No network-based IOCs are expected given the local-only attack vector (GitHub Issue).

Update jq to a version newer than 1.6 (the latest master branch is also reported affected, so monitoring the upstream repository for a patched release is recommended). Oracle Solaris 11.4 users should apply the patch referenced in the January 2026 Third Party Bulletin (Oracle); Microsoft CBL-Mariner users should refer to the MSRC advisory (Microsoft MSRC). As a workaround, validate and sanitize JSON input before processing with jq, avoid invoking jq with --run-tests on untrusted input, and restrict local access to the jq utility in sensitive environments (Red Hat Bugzilla).

Red Hat has tracked the issue as a low-severity bug in their Bugzilla system, with the status remaining NEW and no fixed version listed as of the latest update (Red Hat Bugzilla). Oracle included the CVE in its January 2026 Solaris Third Party Bulletin with a CVSS v3.1 score of 3.3 (Low), indicating limited concern for production environments (Oracle). The vulnerability was discovered through fuzzing by academic researchers at UCAS and reported responsibly via the jqlang GitHub repository, where it was labeled as a bug (GitHub Issue). No significant social media discussion or broader media coverage has been identified.