CVE-2025-9403: jqlang jq JSON jq_test.c run_jq_tests assertion
Vulnerability summary
CVE-2025-9403 is a medium (CVSS 5.5) Reachable Assertion vulnerability in jqlang jq. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 13.1% of scored vulnerabilities. 3 public exploits are recorded.
Not severe (CVSS 4.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 25-08-2025PublishedVulnerability first disclosed.
- 25-08-2025Last modifiedVulnerability information updated.
Description
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:RDiffers
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (drive.google.com)
Maturity: unknown
Jq
Maturity: poc
Exploit Reference (vuldb.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse5 products
- jq&distro=SUSE Linux Enterprise Micro 5.2< 1.6-150000.3.12.1
- jq&distro=SUSE Linux Enterprise Micro 5.3< 1.6-150000.3.12.1
- jq&distro=SUSE Linux Enterprise Micro 5.4< 1.6-150000.3.12.1
- jq&distro=SUSE Linux Enterprise Micro 5.5< 1.6-150000.3.12.1
- jq&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 1.6-150000.3.12.1
Opensuse2 products
- jq&distro=openSUSE Leap 15.6< 1.6-150000.3.12.1
- jq&distro=openSUSE Tumbleweed< 1.8.2-2.1
Debian1 product
- jqAll versions (No fix recorded)
Jqlang1 product
- jq1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 1.5 | 1.6 | ≤ 1.6
Ubuntu1 product
- jqAll versions (No fix recorded)
5 vendors · 10 products
