CVE-2024-53427
Published: 26 February 2025
Summary
CVE-2024-53427 is a high-severity Type Confusion (CWE-843) vulnerability in Jqlang Jq. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-53427 is a stack-based buffer overflow and out-of-bounds write vulnerability in the decNumberCopy function within decNumber.c, affecting jq versions through 1.7.1. The flaw occurs because the function does not properly account for NaN values being interpreted as numeric, leading to improper handling during operations.
A local attacker with no privileges required can exploit this vulnerability, though it demands high attack complexity and no user interaction. Exploitation is triggered via the --slurp option with a subtraction filter such as .-. applied to crafted input, like a digit string containing NaN (e.g., "1 NaN123" immediately followed by many more digits). This results in high impacts to confidentiality, integrity, and availability with a changed scope, as reflected in the CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and mapped to CWE-843 (Access of Resource Using Incompatible Type).
The jq security advisory at GHSA-x6c3-qv5r-7q22, along with GitHub issues #3196 and #3296, provide further details on the vulnerability, including a proof-of-concept in a referenced Gist and analysis of the affected source code line in decNumber.c. Practitioners should consult these resources for patch information and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5310
Vulnerability details
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of…
more
.-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow enables local exploitation for privilege escalation via crafted jq input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, prioritization, and timely remediation of the stack-based buffer overflow flaw in vulnerable jq versions through patching or upgrades.
Implements memory protection mechanisms like stack canaries, ASLR, and non-executable memory to block exploitation of the stack-based buffer overflow and out-of-bounds write.
Mandates validation of information inputs to jq processes to reject crafted strings with embedded NaN that trigger the improper numeric handling and overflow.