7.5

CVE-2025-27788: ruby-lang javascript_object_notation Out-of-bounds Read

CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-27788CGA-4fq9-4pvj-7jhqCGA-56gh-x72w-rfpv
Published 12-03-2025Last modified 12-03-2025
Open JSON

Vulnerability summary

CVE-2025-27788 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in ruby-lang javascript_object_notation. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.72%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 8
CGA-365Q-M7C2-926VCGA-4X27-7GC4-5P6XCGA-79QM-R89J-RR9JCGA-GHH8-76XH-6HWVCGA-MH7P-22QJ-6CFPCGA-RR96-25HV-5HVJ

Timeline

  1. 12-03-2025
    PublishedVulnerability first disclosed.
  2. 12-03-2025
    Last modifiedVulnerability information updated.

Description

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.72%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

+0.01 pp

From 0.71% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.72%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard9 products
  • ruby3.2-fluentd-kubernetes-daemonset-1.16< 1.16.7.1.1-r1
  • ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesis< 1.16.7.1.1-r1
  • ruby3.2-json< 2.10.2-r0
  • ruby3.3-fluentd-kubernetes-daemonset-1.16< 1.16.7.1.1-r1
  • ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesis< 1.16.7.1.1-r1
Wolfi3 products
  • ruby3.2-json< 2.10.2-r0
  • ruby3.3-json< 2.10.2-r0
  • ruby3.4-json< 2.10.2-r0
Ruby1 product
  • json≥ 2.10.0, < 2.10.2
Ruby-lang1 product
RubyGems1 product
  • json≥ 2.10.0, < 2.10.2
Ubuntu1 product
  • ruby-jsonAll versions (No fix recorded)

6 vendors · 16 products

References

9 links