Security readout for executives and security teams
Plain-English summary
jq can misread a filter file if it contains an embedded NUL byte, running only the part before that byte. This can change intended data-processing logic when a user or workflow loads jq programs from files. The issue is local and requires someone to use a malicious or tampered filter file.
Executive priority
Treat as moderate priority. It is not remotely exploitable based on the provided evidence, but it can affect integrity in automation that trusts jq filter files. Prioritize environments where jq filters are supplied through repositories, artifacts, or shared workspaces.
Technical view
CVE-2026-41256 affects jqlang jq 1.8.1 and earlier. Top-level jq programs loaded with -f are truncated at the first embedded NUL byte, creating a prefix/full-buffer mismatch in the compilation path. CVSS 3.1 is 5.5, with local access, low complexity, user interaction, and high integrity impact.
Likely exposure
Exposure is most likely in scripts, CI jobs, build pipelines, or data-processing automation that invoke jq with -f and accept filter files from untrusted or weakly controlled sources.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. Exploitation requires local use of a crafted or modified jq filter file, so risk depends heavily on who can influence files passed to jq with -f.
Researcher notes
Focus analysis on the -f compilation path and embedded NUL handling. The provided description ties this to a post-CVE-2026-33948 prefix/full-buffer mismatch while noting the JSON parser path was already fixed. No exploit-in-the-wild evidence is provided.
Mitigation direction
- Review the GitHub advisory for vendor-confirmed fixes or workarounds.
- Update jq when a vendor-confirmed fixed release is identified.
- Restrict jq filter files to trusted, reviewable sources.
- Reject or quarantine filter files containing embedded NUL bytes.
- Protect CI and automation workspaces from untrusted file modification.
Validation and detection
- Inventory systems running jq 1.8.1 or earlier.
- Search automation for jq invocations using -f.
- Identify workflows where filter files come from users, repositories, artifacts, or temporary directories.
- Check whether controls detect embedded NUL bytes in jq filter files.
- Confirm vendor guidance before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-158: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-41256 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N1.83.6GitHub_MVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fgCVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Null Byte or NUL Character
Improper Neutralization of Null Byte or NUL Character represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.