Skip to content
Fencer Vulns
critical 9.8

CVE-2025-57052 json

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote a…

published 2025-09-03 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-26527

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

Patch / fix

  • cjson Debian 12 1.7.15-1+deb12u4
  • cjson Debian 13 1.7.18-3.1+deb13u1
  • cjson Debian 14 1.7.19-1

debian advisories DEBIAN-CVE-2025-57052

  • cjson Ubuntu 22.04 LTS 1.7.15-1ubuntu0.1
  • cjson Ubuntu 25.10 1.7.18-3.1ubuntu0.1
  • cjson Ubuntu Pro 20.04 LTS 1.7.10-1.1ubuntu0.1~esm1
  • cjson Ubuntu Pro 24.04 LTS 1.7.17-1ubuntu0.1~esm3

ubuntu advisories UBUNTU-CVE-2025-57052

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cjson satellite capsule 6.16, satellite capsule 6.15, satellite 6.16 +1 more 1.7.18-2.el8sat
  • puppet-agent satellite capsule 6.15, satellite 6.15 7.34.0-4.el8sat
  • python-django satellite capsule 6.16, satellite capsule 6.15, satellite 6.16 +1 more 4.2.24-0.1.el8pc
  • python3.11-django satellite capsule 6.16, satellite capsule 6.15, satellite 6.16 +1 more 4.2.24-0.1.el8pc
  • cjson satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 1.7.18-2.el9sat
  • puppet-agent satellite capsule 6.16, satellite 6.16 8.8.1-3.el8sat
  • puppet-agent satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 8.8.1-3.el9sat
  • python-django satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 4.2.24-0.1.el9pc

red hat advisories RHSA-2025:17614RHSA-2025:17613RHSA-2025:17606

  • cJSON SLE Workstation Extension 15 SP7 1.7.19-150700.3.3.1

suse advisories SUSE-SU-2025:03520-1

  • cJSON openSUSE Leap 16.0 1.7.19-160000.1.1
  • cJSON openSUSE Tumbleweed 1.7.19-1.1

opensuse advisories openSUSE-SU-2026:20340-1openSUSE-SU-2025:15583-1

  • cjson Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.7.19-r0

alpine advisories ALPINE-CVE-2025-57052

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-57052 updated cvss 7.5

cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings

  • Red Hat Satellite 6.15 for RHEL 8 cjson 1.7.18-2.el8sat
    fixed: vendor fix “Applications can validate the JSON pointer strings, ensuring they contain only numeric indexes, before calling the cJSON JSON Pointer API functions.” RHSA-2025:17614
  • Red Hat Satellite 6.16 for RHEL 8 cjson 1.7.18-2.el8sat Red Hat Satellite 6.16 for RHEL 9 cjson 1.7.18-2.el9sat
    fixed: vendor fix “Applications can validate the JSON pointer strings, ensuring they contain only numeric indexes, before calling the cJSON JSON Pointer API functions.” RHSA-2025:17613
  • Red Hat Satellite 6.17 for RHEL 9 cjson 1.7.18-2.el9sat
    fixed: vendor fix “Applications can validate the JSON pointer strings, ensuring they contain only numeric indexes, before calling the cJSON JSON Pointer API functions.” RHSA-2025:17606
  • Red Hat Satellite 6.15 for RHEL 8 satellite 6.15.5.5-1.el8sat, puppet-agent 7.34.0-4.el8sat, python-django 4.2.24-0.1.el8pc, satellite-cli 6.15.5.5-1.el8sat, python3.11-django 4.2.24-0.1.el8pc, satellite-common 6.15.5.5-1.el8sat, +1 more Red Hat Satellite 6.16 for RHEL 8 puppet-agent 8.8.1-3.el8sat, satellite 6.16.5.4-1.el8sat, rubygem-kafo 7.4.0.1-1.el8sat, python-django 4.2.24-0.1.el8pc, satellite-cli 6.16.5.4-1.el8sat, python3.11-django 4.2.24-0.1.el8pc, +6 more Red Hat Satellite 6.16 for RHEL 9 puppet-agent 8.8.1-3.el9sat, satellite 6.16.5.4-1.el9sat, rubygem-kafo 7.4.0.1-1.el9sat, python-django 4.2.24-0.1.el9pc, satellite-cli 6.16.5.4-1.el9sat, python3.11-django 4.2.24-0.1.el9pc, +6 more Red Hat Satellite 6.17 for RHEL 9 foreman 3.14.0.8-1.el9sat, satellite 6.17.5-1.el9sat, puppet-agent 8.8.1-3.el9sat, foreman-cli 3.14.0.8-1.el9sat, foreman-ec2 3.14.0.8-1.el9sat, foreman-pcp 3.14.0.8-1.el9sat, +19 more
    not affected: vulnerable code not present “Applications can validate the JSON pointer strings, ensuring they contain only numeric indexes, before calling the cJSON JSON Pointer API functions.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • x-0r.com https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-129 Improper Validation of Array Index
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.