CVE-2025-57052
published 2025-09-03CVE-2025-57052: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.69%
48.8th percentile
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cjson_project | cjson | >= 0 < 1.7.15-1ubuntu0.1 | 1.7.15-1ubuntu0.1 |
| cjson_project | cjson | >= 0 < 1.7.18-3.1ubuntu0.1 | 1.7.18-3.1ubuntu0.1 |
| cjson_project | cjson | >= 0 < 1.7.10-1.1ubuntu0.1~esm1 | 1.7.10-1.1ubuntu0.1~esm1 |
| cjson_project | cjson | >= 0 < 1.7.17-1ubuntu0.1~esm3 | 1.7.17-1ubuntu0.1~esm3 |
| davegamble | cjson | >= 0 < 1.7.14-1+deb11u3 | 1.7.14-1+deb11u3 |
| davegamble | cjson | >= 0 < 1.7.15-1+deb12u4 | 1.7.15-1+deb12u4 |
| davegamble | cjson | >= 0 < 1.7.18-3.1+deb13u1 | 1.7.18-3.1+deb13u1 |
| davegamble | cjson | >= 0 < 1.7.19-1 | 1.7.19-1 |
| davegamble | cjson | 1.5.0 – 1.7.18 | — |
| debian | cjson | < cjson 1.7.15-1+deb12u4 (bookworm) | cjson 1.7.15-1+deb12u4 (bookworm) |
| msrc | azl3_ceph_18.2.2-10_on_azure_linux_3.0 | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
vendor_paloalto·2026-04-08·CVSS 7.8
CVE-2023-2176 [HIGH] PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
PAN-SA-2026-0006 Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2023-2176, CVE-2023-28464, CVE-2023-5633, CVE-2024-0646, CVE-2024-36886, CVE-2024-36971, CVE-2025-57052
Affected products: PAN-OS
Ubuntu
cJSON vulnerabilities
vendor_ubuntu·2026-01-23·CVSS 2.9
CVE-2023-26819 [LOW] cJSON vulnerabilities
Title: cJSON vulnerabilities
Summary: Several security issues were fixed in cJSON.
It was discovered that cJSON incorrectly handled parsing large numbers. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-26819)
It was discovered that cJSON may perform out-of-bounds read when processing
specially crafted JSON files using parse_object. An attacker could possibly
use this issue to expose sensitive information or crash the program.
(CVE-2023-53154)
It was discovered that cJSON incorrectly validated array indices in JSON
pointers, which could result in an out-of-bounds memory access. An attacker
could possibly use this issue to cause a denial of service, or execute
arbitrary code. (CVE-2025-57052)
Instructions: In general, a standard system update will make
Microsoft
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricte
vendor_msrc·2025-09-09·CVSS 9.8
CVE-2025-57052 [CRITICAL] CWE-125 cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricte
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more in
Red Hat
cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
vendor_redhat·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CWE-129 cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
A flaw was found in the cJSON library. A specially crafted JSON pointer string can cause an out-of-bounds access in the decode_array_index_from_pointer function in the cJSON_Utils.c file due to improper array bounds checking, causing a crash to the application linked to the library and resulting in a denial of service.
Statement: Only applications using the cJSON JSON Pointer API, where specially craf
Debian
CVE-2025-57052: cjson - cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_inde...
vendor_debian·2025·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052: cjson - cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_inde...
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Scope: local
bookworm: resolved (fixed in 1.7.15-1+deb12u4)
bullseye: resolved (fixed in 1.7.14-1+deb11u3)
forky: resolved (fixed in 1.7.19-1)
sid: resolved (fixed in 1.7.19-1)
trixie: resolved (fixed in 1.7.18-3.1+deb13u1)
OSV
cjson vulnerabilities
osv·2026-01-23·CVSS 2.9
CVE-2023-26819 [LOW] cjson vulnerabilities
cjson vulnerabilities
It was discovered that cJSON incorrectly handled parsing large numbers. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-26819)
It was discovered that cJSON may perform out-of-bounds read when processing
specially crafted JSON files using parse_object. An attacker could possibly
use this issue to expose sensitive information or crash the program.
(CVE-2023-53154)
It was discovered that cJSON incorrectly validated array indices in JSON
pointers, which could result in an out-of-bounds memory access. An attacker
could possibly use this issue to cause a denial of service, or execute
arbitrary code. (CVE-2025-57052)
GHSA
GHSA-98j5-4649-rfv2: cJSON 1
ghsa_unreviewed·2025-09-03
CVE-2025-57052 [CRITICAL] CWE-125 GHSA-98j5-4649-rfv2: cJSON 1
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
OSV
CVE-2025-57052: cJSON 1
osv·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052: cJSON 1
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-all]
bugzilla·2026-07-01·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-all]
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-all]
+++ This bug was initially created as a clone of Bug #2392949 +++
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
--- Additional comment from Fedora Release Engineering on 2026-05-06 09:01:19 CDT ---
Thi
Bugzilla
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
bugzilla·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42
Bugzilla
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [epel-all]
bugzilla·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [epel-all]
CVE-2025-57052 cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
FEDORA-EPEL-2026-cf4968c198 (cjson-1.7.19-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/F
Bugzilla
CVE-2025-57052 mmc: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
bugzilla·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052 mmc: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
CVE-2025-57052 mmc: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on
Bugzilla
CVE-2025-57052 cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
bugzilla·2025-09-03·CVSS 9.8
CVE-2025-57052 [CRITICAL] CVE-2025-57052 cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
CVE-2025-57052 cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Discussion:
This issue has been addressed in the following products:
Red Hat Satellite 6.17 for RHEL 9
Via RHSA-2025:17606 https://access.redhat.com/errata/RHSA-2025:17606
---
This issue has been addressed in the following products:
Red Hat Satellite 6.16 for RHEL 8
Red Hat Satellite 6.16 for RHEL 9
Via RHSA-2025:17613 https://access.redhat.com/errata/RHSA-2025:17613
---
This is
2025-09-03
Published