CVE-2025-57052

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-57052
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57052.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-57052
Downstream
Published
2025-09-03T15:15:38Z
Modified
2025-09-24T12:43:56.418554Z
Summary
[none]
Details

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decodearrayindexfrompointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

References

Affected packages

Git / github.com/davegamble/cjson

Affected ranges

Type
GIT
Repo
https://github.com/davegamble/cjson
Events

Affected versions

v1.*

v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9