CVE-2021-32292: json-c Out-of-bounds Write
Modified
AliasesUBUNTU-CVE-2021-32292USN-6310-1DEBIAN-CVE-2021-32292DSA-5486-1
Published 22-08-2023Last modified 14-10-2026
Vulnerability summary
CVE-2021-32292 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in json-c. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
1.35%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Timeline
- 22-08-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.35%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 1.29% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJson C
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- json-c< 0.15-2+deb11u1 | < 0.16-1
Json-c1 product
- json-c0.15-20200726
Netapp1 product
Ubuntu1 product
- json-c< 0.15-3~ubuntu1.22.04.2
4 vendors · 4 products
References
9 links
- security.netapp.com/advisory/ntap-20230929-0010/Third Party Advisory
