CVE-2025-57052: Out-of-bounds Read
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decodearrayindexfrompointer function in cJSONUtils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply compensating controls for the exposed JSON pointer feature/functionality (e.g., restrict or sanitize usage of JSON pointer strings sent by untrusted/remote clients) to limit exploitation while upgrading from cJSON 1.5.0 through 1.7.18.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57052?
CVE-2025-57052 is classified as a high severity vulnerability due to the potential for remote code execution through out-of-bounds access.
How do I fix CVE-2025-57052?
To fix CVE-2025-57052, update cJSON to version 1.7.19 or later, which addresses the out-of-bounds access vulnerability.
What systems are affected by CVE-2025-57052?
CVE-2025-57052 affects cJSON versions from 1.5.0 through 1.7.18.
What type of attacks can exploit CVE-2025-57052?
CVE-2025-57052 can be exploited by remote attackers using malformed JSON pointer strings to access restricted data.
What functionality is impacted by CVE-2025-57052?
CVE-2025-57052 impacts the decode_array_index_from_pointer function, allowing array bounds checking to be bypassed.