CVE-2025-57052: davegamble cjson Out-of-bounds Read
Vulnerability summary
CVE-2025-57052 is a critical (CVSS 9.8) Out-of-bounds Read vulnerability in davegamble cjson. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 03-09-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.74% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (x-0r.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Affected systems
Alpine1 product
- cjson≥ 1.5.0, < 1.7.19-r0
Davegamble1 product
- cjson≥ 1.5.0, ≤ 1.7.18
Debian1 product
- cjson< 1.7.19-1 | < 1.7.15-1+deb12u4 | < 1.7.18-3.1+deb13u1 | < 1.7.14-1+deb11u3
Ubuntu1 product
- cjson< 1.7.10-1.1ubuntu0.1~esm1 | < 1.7.15-1ubuntu0.1 | < 1.7.17-1ubuntu0.1~esm3 | < 1.7.18-3.1ubuntu0.1
4 vendors · 4 products
