CVE-2025-57052

critical · 9.8

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

9.8

CVSS

0.7%

EPSS (exploit prob.)

53rd

EPSS percentile

2025-09-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-125CWE-129

Affected products

Vendor	Product	Affected versions
davegamble	cjson	>= 1.5.0, <= 1.7.18

Check a specific version with /api/v1/cve/match.

References

https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-57052