CVE-2025-57052

An attacker sends a specially crafted JSON pointer string containing alphanumeric characters, which is incorrectly processed by the decode_array_index_from_pointer function. This function does not properly validate array indices (CWE-129 — improper validation of array index), leading to reading data outside the permitted memory range (CWE-125 — out-of-bounds read). As a result, the array boundary checking mechanism is bypassed, and the library gains access to memory areas exceeding the allocated buffer.

A remote attacker can gain access to protected data in the application's memory, threatening the confidentiality, integrity, and availability of the system. Due to the critical CVSS score (9.8) and no authentication requirements, the vulnerability poses serious risk in any environment where the application processes untrusted JSON data.

The cJSON library should be updated to a version higher than 1.7.18, in which the vulnerability was removed. Users of Debian distributions should apply patches published as part of debian-lts-announce (September 2025). Detailed information is available at: https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability and https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html

The cJSON library (authored by Davegamble) in versions 1.5.0 to 1.7.18 inclusive; affects all applications using the cJSON_Utils.c component