CRITICAL🇵🇱 Wersja polska

CVE-2018-1000217

CVSS 9.8v3.0pub. 2018-08-20upd. 2025-07-22

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Davegamble Cjson

    APP
    Davegamble
    < 1.7.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2025-57052CRITICAL9.8PL ✓same product

Out-of-bounds access w cJSON przez funkcję decode_array_index_from_pointer

CVE-2019-11835CRITICAL9.8PL ✓same product

Dostęp poza zakresem pamięci w cJSON związany z komentarzami wieloliniowymi

CVE-2019-11834CRITICAL9.8PL ✓same product

cJSON: out-of-bounds access przez znak \x00 w literale tekstowym

CVE-2016-10749CRITICAL9.8PL ✓same product

Buffer over-read w funkcji parse_string biblioteki cJSON

CVE-2026-67215HIGH8.7PL ✓same product

cJSON: niekontrolowana rekurencja prowadząca do wyczerpania stosu (DoS)