CVE-2025-6566: oatpp Oat++ Deserializer.cpp deserializeArray stack-based overflow

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-24 · updated 2026-06-17
Weakness: CWE-119

Description

A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the function deserializeArray of the file src/oatpp/json/Deserializer.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

oatpp Oat++: through 1.3.1

References

https://github.com/oatpp/oatpp/issues/1037
https://github.com/user-attachments/files/19579448/oatpp_crash.txt
https://vuldb.com/?ctiid.313738
https://vuldb.com/?id.313738
https://vuldb.com/?submit.597453
https://github.com/oatpp/oatpp/issues/1037

Get alerted when CVE-2025-6566 or the next vulnerability affects your stack