CVE-2025-57052

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-03 · updated 2026-06-17
Weakness: CWE-125

Description

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

Affected products

DaveGamble cJSON: from 1.5.0 through 1.7.18

References

https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html

Get alerted when CVE-2025-57052 or the next vulnerability affects your stack