How severe is CVE-2025-9403?

CVE-2025-9403 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-9403 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-9403?

CVE-2025-9403 affects Jqlang Jq. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-9403?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-9403 have an EU (EUVD) identifier?

Yes. CVE-2025-9403 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-25716.

When was CVE-2025-9403 published?

CVE-2025-9403 was published on 2025-08-25 and last updated on 2026-06-17.

CVE-2025-9403

CVE-2025-9403 is a low-severity vulnerability in Jqlang Jq with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-617.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v2: 1.7
CVSS v4: 1.9
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-25716
Weakness: CWE-617
Affected product: Jqlang Jq
Published: 2025-08-25
Last modified: 2026-06-17

Description

A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.

Frequently asked questions

What is CVE-2025-9403?: A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
How severe is CVE-2025-9403?: CVE-2025-9403 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-9403 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-9403?: CVE-2025-9403 affects Jqlang Jq. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-9403?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-9403 have an EU (EUVD) identifier?: Yes. CVE-2025-9403 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-25716.
When was CVE-2025-9403 published?: CVE-2025-9403 was published on 2025-08-25 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*

More vulnerabilities in Jqlang Jq

CVE-2026-32316 — High (CVSS 8.2): jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the…
CVE-2024-53427 — High (CVSS 8.1): decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which…
CVE-2025-48060 — High (CVSS 7.5): jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in…
CVE-2023-49355 — High (CVSS 7.5): decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111"…
CVE-2026-49839 — High (CVSS 7.1): jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into…
CVE-2026-39979 — Medium (CVSS 6.5): jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()…

All CVEs affecting Jqlang Jq →

Other CWE-617 (Reachable Assertion) vulnerabilities

CVE-2020-3615 — Critical (CVSS 9.8): Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue…
CVE-2019-9795 — Critical (CVSS 9.8): A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by…
CVE-2026-31739 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The…
CVE-2020-12417 — High (CVSS 8.8): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in…
CVE-2020-6623 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
CVE-2020-6619 — High (CVSS 8.8): stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.

Browse all CWE-617 (Reachable Assertion) vulnerabilities →